auth now sets api key