enable token use, add id and secret to config