private api nonce check