use built-in token auth