revamped api so uses token