Validate by auth info, actually use key