working on the auth structure for the API