added flag to allow skipping of getAPIKey for known unauthorised accounts