auth_api fully covered