don't worry about API users before starting up
initial support for key-based access