all principals should be assigned the api_key that created them (the user itself for users)