fix scoping of api-url
add tests for API keys