what is the bearer token in api calls is it my api key only?