`add` token validation api and some update