token lifecycle