api token sets correctly