API authentication now uses tokens