Unsigned uploads do not require api_key