diff --git a/packages/@jsonql/koa/package.json b/packages/@jsonql/koa/package.json
index 52f22d1d3dbfd46299aa20fc0cae8ee05d4944b9..d5556857f73e0a7ced4ce13529ad6a538cb3fd66 100644
--- a/packages/@jsonql/koa/package.json
+++ b/packages/@jsonql/koa/package.json
@@ -53,7 +53,7 @@
     "debug": "^4.1.1",
     "fs-extra": "^8.1.0",
     "jsonql-constants": "^1.8.10",
-    "jsonql-koa": "^1.4.6",
+    "jsonql-koa": "^1.4.7",
     "jsonql-params-validator": "^1.4.11",
     "koa": "^2.11.0",
     "koa-bodyparser": "^4.2.1",
diff --git a/packages/@jsonql/koa/src/index.js b/packages/@jsonql/koa/src/index.js
index bb8f5bd273701af03526c5aad5e81962c802f15f..62f6e3b6d204d3514647da39928e5b9b03b8c839 100644
--- a/packages/@jsonql/koa/src/index.js
+++ b/packages/@jsonql/koa/src/index.js
@@ -3,18 +3,17 @@ const http = require('http')
 const Koa = require('koa')
 const bodyparser = require('koa-bodyparser')
 const cors = require('koa-cors')
-// const contractApi = require('jsonql-koa/contract')
+/* require('../../../koa/main') */
 const { jsonqlKoa } = require('jsonql-koa')
 const { getSocketServer } = require('./get-socket-server')
 
-
 /**
  * @param {object} config configuration
  * @param {array} middlewares what it said
  * @return {object} see below for detail
  */
 function initServer(config, middlewares) {
-  
+
   const app = new Koa()
   // apply default middlewares
   app.use(bodyparser())
diff --git a/packages/@jsonql/koa/tests/auth.test.js b/packages/@jsonql/koa/tests/auth.test.js
index f39c3841e90450031cbd9dd965e07d89b1af35d8..c9fd2e64595b8c8e11439b33398a612739939fc4 100644
--- a/packages/@jsonql/koa/tests/auth.test.js
+++ b/packages/@jsonql/koa/tests/auth.test.js
@@ -1,6 +1,7 @@
 const test = require('ava')
 const fsx = require('fs-extra')
 const { join } = require('path')
+const debug = require('debug')('jsonql-koa:test:auth')
 const jsonqlNodeClient = require('jsonql-node-client')
 const { JS_WS_NAME, HELLO } = require('jsonql-constants')
 const jsonqlKoaServer = require('./fixtures/test-server')
@@ -13,7 +14,6 @@ test.before(t => {
     port: port,
     autoStart: true,
     enableAuth: true
-    // socketType: JS_WS_NAME
   })
 
   t.context.stop = stop;
@@ -22,22 +22,48 @@ test.before(t => {
 test.after( t => {
   t.context.stop()
   fsx.removeSync(contractDir)
+  fsx.removeSync(join(__dirname, 'fixtures', 'keys'))
 })
 
-test.serial(`It should able to setup a auth server`, async t => {
+test.beforeEach(async t => {
   t.context.client = await jsonqlNodeClient({
     hostname: `http://localhost:${port}`,
     enableAuth: true,
     contractDir
   })
+})
 
-  const result = await t.context.client.query.helloWorld()
-
+test.serial(`It should able to setup a auth server`, async t => {
+  const client = t.context.client;
+  const result = await client.query.helloWorld()
   t.is(result, HELLO)
 })
 
-test.todo(`It should not able to connect to a private method`)
+test.serial(`It should not able to connect to a private method`, async t => {
+  const client = t.context.client
+  const error = await t.throwsAsync(client.query.getSecretMsg())
+	t.true(error.message.indexOf('JsonqlAuthorisationError') > -1)
+})
+
+test.serial.cb(`It should able to login`, t => {
+  t.plan(2)
+  const client = t.context.client
+  const name = 'Joel'
+  client.login(name)
+    .then(result => {
+      const userdata = client.userdata()
+      t.is(userdata.name, name)
 
-test.todo(`It should able to login`)
+      client.query.getSecretMsg()
+        .then(result => {
+          t.is(result, 'Let me tell ya a secret ...')
+          t.end()
+        })
+
+    })
+    .catch(err => {
+      debug('login error', err)
+    })
+})
 
 test.todo(`It should able to connect to a private method after login`)
diff --git a/packages/@jsonql/koa/tests/fixtures/resolvers/auth/login.js b/packages/@jsonql/koa/tests/fixtures/resolvers/auth/login.js
new file mode 100644
index 0000000000000000000000000000000000000000..2db3d32648e85ddecb6a8822f839631a688027bb
--- /dev/null
+++ b/packages/@jsonql/koa/tests/fixtures/resolvers/auth/login.js
@@ -0,0 +1,10 @@
+const debug = require('debug')('jsonql-koa:resolvers:auth:login')
+/**
+ * login method
+ * @param {string} name give it a name
+ * @return {object} a userdata object with timestamp
+ */
+module.exports = function login(name) {
+  debug(`Login got call with ${name}`)
+  return { name, timestamp: Date.now() }
+}
diff --git a/packages/koa/package.json b/packages/koa/package.json
index 5ff8c1d50a33f312d2ed458ddae9dc6256de14a4..4cd16f0398f7816fc55c400a6432ceb5fc03f0db 100644
--- a/packages/koa/package.json
+++ b/packages/koa/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jsonql-koa",
-  "version": "1.4.7",
+  "version": "1.4.8",
   "description": "jsonql Koa middleware",
   "main": "main.js",
   "module": "index.js",
diff --git a/packages/koa/src/middlewares/auth-middleware.js b/packages/koa/src/middlewares/auth-middleware.js
index 3ba9164d6a36299483ad9990d57ef2a97685594b..52829346281504a5f80a59e9f0d30fb1319f642c 100644
--- a/packages/koa/src/middlewares/auth-middleware.js
+++ b/packages/koa/src/middlewares/auth-middleware.js
@@ -76,6 +76,7 @@ const createJwtValidatorChain = (config, validator = false) => {
   if (!validator || typeof validator !== 'function') {
     return jwtFn;
   }
+
   return chainFns(jwtFn, validator)
 }
 
@@ -95,17 +96,19 @@ const getValidator = (config, type, contract) => {
   try {
     localValidator = getLocalValidator(config, type, contract)
   } catch(e) {
+    const checkErr = e instanceof JsonqlResolverNotFoundError
+    // debug('checkErr', checkErr)
     // we ignore this error becasue they might not have one?
-    if (!(e instanceof JsonqlResolverNotFoundError)) {
+    if (!checkErr) {
       return finalCatch(e)
     }
   }
-  if (config.useJwt) {
-    debug(`return the jwt validation chain`)
-    return createJwtValidatorChain(config, localValidator)
-  }
-  debug(`return a local validator`)
-  return localValidator;
+  // if (config.useJwt) { // we always use the jwt opiton now
+  ///debug(`return the jwt validation chain`)
+  return createJwtValidatorChain(config, localValidator)
+  //}
+  // debug(`return a local validator`)
+  // return localValidator;
 }
 
 /**