add json api, add auth to fetch too