allow for multiple api keys per auth record