added api_key verification