fix api key and permission