I am trying out the PermissionsKey feature and it doesn't seem to be doing what I expect. Using the example from the documentation I created the following APIFunction and expected it not to return and answer when the wrong key is sent.

In[3] below seems like it should not return the result. Am I misunderstanding what the PermissionsKey should be doing?

In[1]:= obj =  CloudDeploy[APIFunction[{"n" -> Integer}, #n^2 &],  Permissions -> {PermissionsKey["thekey"] -> "Execute"}]
Out[1]= CloudObject["https://www.wolframcloud.com/objects/166e0320-8df8-4860-be3c-12eff233d6e7"]

In[2]:= URLExecute[obj, {"n" -> 123}, Authentication -> PermissionsKey["thekey"]]
Out[2]= 15129

In[3]:= URLExecute[obj, {"n" -> 123}, Authentication -> PermissionsKey["wrongkey"]]
Out[3]= 15129