you need to offer api key reset for security