base64-encode api key in config page instead of in the app