api authentication setup