document the format of opts.auth