refactor api auth