api auth is working