token param is required and must not empty