load token from env or config