More work on auth against api