add api-auth endpoint