check that code works if no onsite key is provided

We assume this everywhere and code will likely break