auth can store token in a file