use auth config instead