bugfix: api request authorization