Electrocardiogram (ECG) have been investigated as potential biometrics for user authentication by many research groups. Feature extraction is critical to yield good performance for ECG based user authentication and many methods have been proposed. In this paper, we propose a method of feature extraction using time-varying power spectral density (PSD) and auto-regressive (AR) model. We also investigated the impact of AR model order on the performance of user authentication. Our proposed method yielded 4.3% EER (equal error rate) and 99.13% AUC (area under curve) with public ECG-ID database when using the 4th order AR model.