API authentication is now does by headers