token auth with api namespacing