save api keys through appconfig, so closed #8