API: Overhaul token handling