pass public_key in param instead of url path