Shouldn't it be enclosed in <%- if @webui['api_key'] -%> ?
If one don't set an api_key I'm afread this will generate an unvalid json file.