API authentication using token