auth first, search next