add api key authentication