some api and custom token auth