api sign in gets auth token