auth add and remove, need get