authentication spec for api