fix: client credentials are not required, add apikey validation (#154)

fix: client credentials are not required, add apikey validation (#154) #66