On second thought the api key should be owned by root to match the rest of the config files.