api key is now passed as header instead of query param