use client auth instead of secrets