first pass at exposing API token #1098