toy authorization service