initial implementation, TODO: return tokens from requests