some auth code but not complete