return API token as string