fixed: no secret in auth url