api_key should be unique
make it clear what username basic auth uses
add api authz