[api] use device specific token