validate key from whitelist