only one api_token at a time