prototype protected access to API on auth server side