rework authentication API