other question: how do you hide your API key if you're making a js/jq app?