api keys are checked for authentication