update api_auth
set header before signing