401 if key is missing