auth: api_token: !add