change verify() to work with multiple api-keys which are comma-separated