additional fields in authorization