better login control + API endpoint environment config