[core] get token outside secure scope