token generation checks for valid api_key and tests