rewrite api-auth