API authentication without giving panel access