api key should have type password