Add api_key check before action