Harden the API with keys