simple validation of api key - I think it can be done here because it seems to always be required