use allowy for service auth token permissions