allowed api to access login function