permission and api key