api: auth is required.