manually doing oauth