auth & create (1/2)