enable api access via domain token