V4 Custom API Token validation

General
2

it’s a bad idea to trust client side token, don’t