fix: use token in the manifest