Limit BE to characters belong to API key.