Only checking upload params signature when an API key is used