simple API with hidden token at random location and a solution to check against