properly manage api keys