add apikey auth for api endpoints