externalize api key to also support ENV