document auth flow in API V1