use authenticate in APIs