allow tokens and keys as url params