Support API key and secret

These changes are incompatible with the previous username/password
authentication implementation