hardcoded auth url