[auth] fix api key auth