asserting that apiKey/secret is set
fixed cancelation url