require users to get their own API key