init api: add inner user for api server
auth api: check api server signature done, check client signature TBD