Both id and token are required