validate api_key