API Auth Is Deeper Than It Looks