use allowed keys in request