make api key hidden