untested auth code support