rename api_key to auth_token