use environment variables for auth