put api key/secret in request url instead of customized headers to avoid some issues caused by China network operators