auth api improvements