pass key as header rather than on url