fixed api auth