How to setup an API key and restrict access for any team?