authenticate from outside