a temporary working api with token authentication