user:create doesn't add apikey because server-side creates one automatically
added user:apikey:add and user:apikey:remove