Endpoint-level auth