move api token config to env