add a token for the api to our login callback