private function validateAPIToken($token, $request)
    {
        //get owner with that token
        $SQL_token = Convert::raw2sql($token);
        $tokenColumn = $this->tokenConfig['DBColumn'];

        $tokenOwner = DataObject::get_one(
            $this->tokenConfig['owner'],
            "\"" . $this->tokenConfig['DBColumn'] . "\"='" . $SQL_token . "'",
            false
        );

        if ($tokenOwner) {
            //check token expiry
            $tokenExpire = $tokenOwner->{$this->tokenConfig['expireDBColumn']};
            $now = time();
            $life = $this->tokenConfig['life'];

            if ($tokenExpire > ($now - $life)) {
                // check if token should automatically be updated
                if ($this->tokenConfig['autoRefresh']) {
                    $tokenOwner->setField($this->tokenConfig['expireDBColumn'], $now + $life);
                    $tokenOwner->write();
                }
                //all good, log Member in
                if (is_a($tokenOwner, Member::class)) {
                    # this is a login without the logging
                    Config::nest();
                    Config::modify()->set(Member::class, 'session_regenerate_id', true);
                    $identityStore = Injector::inst()->get(IdentityStore::class);
                    $identityStore->logIn($tokenOwner, false, $request);
                    Config::unnest();
                }

                return true;
            } else {
                //too old
                return new RESTfulAPIError(403,
                    'Token expired.',
                    array(
                        'message' => 'Token expired.',
                        'code' => self::AUTH_CODE_TOKEN_EXPIRED,
                    )
                );
            }
        } else {
            //token not found
            //not sure it's wise to say it doesn't exist. Let's be shady here
            return new RESTfulAPIError(403,
                'Token invalid.',
                array(
                    'message' => 'Token invalid.',
                    'code' => self::AUTH_CODE_TOKEN_INVALID,
                )
            );
        }
    }