update api, auth