restrict access to api except by key