auth.tokenIdKey is optional