[api] default to oauth for api authentication