api-token to package.json and app.js