use token instead of id