token is mandatory