add api authentication