change token to create after validate