move api and auth around