API Key validation, rate limiting