eliminate api_key from signature calculation