Always set API key for unsigned requests