use the API Key as little as possible and use a token system to hand out temp keys which can be renewed every (time unit)