external api with authentication