add ability to have secret api key serverside