use apiKey and userId