normalize api key handling