api key not hard coded