token only is public, not full