changed from using master key with HTTP auth to API key with header auth