updated to include a root api key for access control