ClientAuth instead of exposing client