new token only supports sign auth