secured api endpoints with oauth2