added protected key to the api routes