fixed 401 authorization bug and added api keys with validation