[#32] use users api token instead of client key