- client side: token is configurable