changing some terminology: authorize is actually authenticate, endpoints are base URLs, ...