first step to token authentication