Yup, you can pass the API key, but it will be something like in the x-vapi-secret header format, where you need to validate the data from your side