describe first auth step