make user key required and access_token configurable