API key authentication, first pass