how to hide api keys