fixed auth for api