API heatmap permission based on hardcoded API key