Add API key rights. close #33