Add extra check on token format in proxy api()