api requests should use the users's api key