hide token inside