use the TH-Api-Key not Authorization heeader