api - new private_token security system