auth string only