add support for hidden api keys, used in hosting scenarios