allow null appkey+secret