fix bug in token api