2 steph authentication - external auth