User / flow tokens explained