API key authentication works