whitelist and clean up app keys for update and create