error message should indicate that api_key is missing or inactive, not auth_token