client auth and api auth linked