How I handle API key validation + rate limiting