logic for storing password was incorrect, we should only store password if there is no apiKey to use for later