use auth for swagger api