Add out-of-band auth, + always call a callback