use config; real auth