specs for authorization