Is the auth endpoint correct? We need to double check.