api keys need sanity