Validate does not need clientToken