document auth config