token is required and must not empty