use env variables for auth