allowed -> do not rely
each auth ns needs key