replace hardcoded keys with environment variables