Which way should be used to safely the API keys?