Provision Script with unique Token

very simple: you don’t call the api from the extension. Something as I suggested here