working on api session token