api token support while waiting for OAuth