add basic api key auth