api auth fix