~allowed_hosts, ++api keys in another place