how to hide an api key