first run, API auth success