add auth method to api