auth specs