Would have been nice to have here - information before. The new authentication API isn’t easy stuff.
Dr. google told me it could be something to do with whitelist_external_dirs:. As the API works with external dir give it a try.
As first step it’s easier to use the build-in auth provider?