new auth flow; notifications