change auth parameter to use object to avoid magic strings