Protect /notify and /blocknotify with api_key