externalize auth