Only authenticate api user