if specified, use REST API key for login too