fix API key validation