securing the client id and secret in environment variables instead of code
moved API url to environment variable