the auto-detection doesn't work. need a parameter that lets you force use the old auth secret or the new admin api pk.