Secure API keys

/cc @josevalim 
Is this secret on the right side used just for testing? If so I would move it to development and test environment. If someone does a custom hex deploy, we don't want them to run on a public secret.