single method and test for endpoint auth