use app id and key to auth in api