fix: auth method 2 (shadow)