Add auth logic to API