Req and auth are required.