how to secure api gateway with keys