open protocol to allow API authentication