remove api keys from route into config