give them a new api key after they posted theirs