auth and fetch token