hide api key javascript