finish api key authentication spec