[refactor] use pass for auth