api only middleware