validate api key