2 stage token process