token from keystone
token from keystone with hierarchy