Look for the api_key in $_COOKIE rather than $_REQUEST.

For Mr. Reader, we set a cookie on the login message and then look for
it on subsequent requests. We need to check $_COOKIE rather than
$_REQUEST though as the values in $_REQUEST are set within php.ini and
cookies are not often set there since the PHP org changed the default
setting of "request_order" to be "GP".