validate api key on request