v0.0.16

Changes

• Add proper API validation in _validate_credentials
• Get API key from runtime.credentials in Tool
• Remove hardcoded API key
• Fix credential flow: user must provide valid API key