first rest api steps, with OAuth