protect API keys