seperate public and private apis and fix auth