move api key to env