fix api auth