add api authentication mechanism