authenticate API calls