auth code moved to shared