refactor API auth code