key does not need to be decoded - it was used in base64encoded form
for encryption.

token had a stray newline.