ensure that api token is not exposed