login via apikey