add headers and done auth