allow api_key to be app_id.app_key