specs for auth