user api key validation