fix params typo, permit token