initial working token / code auths