letting the API key be specified by client