token must be at least 30 characters long