how should application programming interface api tokens be treated