auth with qrcode