add login API without whoAmI