Changed api_key handling so it is used for token authentication