fixed: allowed type for auth code