ST_API_KEY should be ST_CLIENT_SECRET