this should not return the apikey