enforcing use of api key