attachment and authentication API