allow empty key for server-side validation