Work in progress... API is not final, but auth flow works