use token instead of code