diff --git a/cmd/monaco/download/download_configs_test.go b/cmd/monaco/download/download_configs_test.go
index 0d703f712..59b29229b 100644
--- a/cmd/monaco/download/download_configs_test.go
+++ b/cmd/monaco/download/download_configs_test.go
@@ -143,7 +143,7 @@ func TestDownloadConfigsBehaviour(t *testing.T) {
 			tt.givenOpts.downloadOptionsShared = downloadOptionsShared{
 				environmentURL: "testurl.com",
 				auth: manifest.Auth{
-					Token: manifest.AuthSecret{
+					Token: &manifest.AuthSecret{
 						Name:  "TEST_TOKEN_VAR",
 						Value: "test.token",
 					},
@@ -174,7 +174,7 @@ func TestDownload_Options(t *testing.T) {
 			"download all if options are not limiting",
 			downloadConfigsOptions{
 				downloadOptionsShared: downloadOptionsShared{
-					auth: manifest.Auth{OAuth: &manifest.OAuth{}}, // OAuth required to be defined for platform types
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}, OAuth: &manifest.OAuth{}}, // OAuth and Token required to download whole config
 				},
 			},
 			wantDownload{
@@ -188,17 +188,26 @@ func TestDownload_Options(t *testing.T) {
 		},
 		{
 			"only settings requested",
-			downloadConfigsOptions{onlySettings: true},
+			downloadConfigsOptions{
+				onlySettings: true,
+				downloadOptionsShared: downloadOptionsShared{
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}},
+				}},
 			wantDownload{settings: true},
 		},
 		{
 			"specific settings requested",
-			downloadConfigsOptions{specificSchemas: []string{"some:schema"}},
+			downloadConfigsOptions{
+				specificSchemas: []string{"some:schema"},
+				downloadOptionsShared: downloadOptionsShared{
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}},
+				}},
 			wantDownload{settings: true},
 		},
 		{
 			"only documents requested",
-			downloadConfigsOptions{onlyDocuments: true,
+			downloadConfigsOptions{
+				onlyDocuments: true,
 				downloadOptionsShared: downloadOptionsShared{
 					auth: manifest.Auth{OAuth: &manifest.OAuth{}},
 				}},
@@ -206,7 +215,8 @@ func TestDownload_Options(t *testing.T) {
 		},
 		{
 			"only openpipeline requested",
-			downloadConfigsOptions{onlyOpenPipeline: true,
+			downloadConfigsOptions{
+				onlyOpenPipeline: true,
 				downloadOptionsShared: downloadOptionsShared{
 					auth: manifest.Auth{OAuth: &manifest.OAuth{}},
 				}},
@@ -214,12 +224,20 @@ func TestDownload_Options(t *testing.T) {
 		},
 		{
 			"only apis requested",
-			downloadConfigsOptions{onlyAPIs: true},
+			downloadConfigsOptions{
+				onlyAPIs: true,
+				downloadOptionsShared: downloadOptionsShared{
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}},
+				}},
 			wantDownload{config: true},
 		},
 		{
 			"specific config apis requested",
-			downloadConfigsOptions{specificAPIs: []string{"alerting-profile"}},
+			downloadConfigsOptions{
+				specificAPIs: []string{"alerting-profile"},
+				downloadOptionsShared: downloadOptionsShared{
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}},
+				}},
 			wantDownload{config: true},
 		},
 		{
@@ -234,7 +252,12 @@ func TestDownload_Options(t *testing.T) {
 		},
 		{
 			"specific APIs and schemas",
-			downloadConfigsOptions{specificAPIs: []string{"alerting-profile"}, specificSchemas: []string{"some:schema"}},
+			downloadConfigsOptions{
+				specificAPIs:    []string{"alerting-profile"},
+				specificSchemas: []string{"some:schema"},
+				downloadOptionsShared: downloadOptionsShared{
+					auth: manifest.Auth{Token: &manifest.AuthSecret{}},
+				}},
 			wantDownload{config: true, settings: true},
 		},
 	}
@@ -375,7 +398,7 @@ func TestDownloadConfigsExitsEarlyForUnknownSettingsSchema(t *testing.T) {
 		downloadOptionsShared: downloadOptionsShared{
 			environmentURL: "testurl.com",
 			auth: manifest.Auth{
-				Token: manifest.AuthSecret{
+				Token: &manifest.AuthSecret{
 					Name:  "TEST_TOKEN_VAR",
 					Value: "test.token",
 				},
@@ -397,7 +420,7 @@ func TestMapToAuth(t *testing.T) {
 	t.Run("Best case scenario only with token", func(t *testing.T) {
 		t.Setenv("TOKEN", "token_value")
 
-		expected := &manifest.Auth{Token: manifest.AuthSecret{Name: "TOKEN", Value: "token_value"}}
+		expected := &manifest.Auth{Token: &manifest.AuthSecret{Name: "TOKEN", Value: "token_value"}}
 
 		actual, errs := auth{token: "TOKEN"}.mapToAuth()
 
@@ -410,7 +433,7 @@ func TestMapToAuth(t *testing.T) {
 		t.Setenv("CLIENT_SECRET", "client_secret_value")
 
 		expected := &manifest.Auth{
-			Token: manifest.AuthSecret{Name: "TOKEN", Value: "token_value"},
+			Token: &manifest.AuthSecret{Name: "TOKEN", Value: "token_value"},
 			OAuth: &manifest.OAuth{
 				ClientID:      manifest.AuthSecret{Name: "CLIENT_ID", Value: "client_id_value"},
 				ClientSecret:  manifest.AuthSecret{Name: "CLIENT_SECRET", Value: "client_secret_value"},
diff --git a/cmd/monaco/download/download_integration_test.go b/cmd/monaco/download/download_integration_test.go
index 709f1fb3c..02fbd0d65 100644
--- a/cmd/monaco/download/download_integration_test.go
+++ b/cmd/monaco/download/download_integration_test.go
@@ -1237,7 +1237,7 @@ func setupTestingDownloadOptions(t *testing.T, server *httptest.Server, projectN
 		downloadOptionsShared: downloadOptionsShared{
 			environmentURL: server.URL,
 			auth: manifest.Auth{
-				Token: manifest.AuthSecret{
+				Token: &manifest.AuthSecret{
 					Name:  "TOKEN_ENV_VAR",
 					Value: "token",
 				},
diff --git a/cmd/monaco/dynatrace/dynatrace.go b/cmd/monaco/dynatrace/dynatrace.go
index 6fc4c1a94..5dc576895 100644
--- a/cmd/monaco/dynatrace/dynatrace.go
+++ b/cmd/monaco/dynatrace/dynatrace.go
@@ -56,6 +56,11 @@ func VerifyEnvironmentGeneration(envs manifest.Environments) bool {
 }
 
 func isValidEnvironment(env manifest.EnvironmentDefinition) bool {
+	if env.Auth.Token == nil && env.Auth.OAuth == nil {
+		log.Error("no token and oAuth provided in manifest")
+		return false
+	}
+
 	if env.Auth.OAuth == nil {
 		return isClassicEnvironment(env)
 	}
diff --git a/cmd/monaco/dynatrace/dynatrace_test.go b/cmd/monaco/dynatrace/dynatrace_test.go
index ce5caea6f..1fb134863 100644
--- a/cmd/monaco/dynatrace/dynatrace_test.go
+++ b/cmd/monaco/dynatrace/dynatrace_test.go
@@ -134,7 +134,7 @@ func TestVerifyEnvironmentGen(t *testing.T) {
 					Name:  "URL",
 					Value: server.URL,
 				},
-				Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "DT_API_TOKEN", Value: "some token"}},
+				Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "DT_API_TOKEN", Value: "some token"}},
 			},
 		})
 		assert.True(t, ok)
diff --git a/pkg/converter/converter_test.go b/pkg/converter/converter_test.go
index 1fa4c52b1..aba030b44 100644
--- a/pkg/converter/converter_test.go
+++ b/pkg/converter/converter_test.go
@@ -63,7 +63,7 @@ func TestConvertParameters(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -181,7 +181,7 @@ func TestConvertConvertRemovesEscapeCharsFromParameters(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -350,7 +350,7 @@ func TestLoadPropertiesForEnvironment(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: groupName,
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -403,7 +403,7 @@ func TestConvertConfig(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -471,7 +471,7 @@ func TestConvertDeprecatedConfigToLatest(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -545,7 +545,7 @@ func TestConvertConfigWithEnvNameCollisionShouldFail(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -590,7 +590,7 @@ func TestConvertSkippedConfig(t *testing.T) {
 		URL:   createSimpleUrlDefinition(),
 		Group: "",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "token"},
+			Token: &manifest.AuthSecret{Name: "token"},
 		},
 	}
 
@@ -643,7 +643,7 @@ func TestConvertConfigs(t *testing.T) {
 			URL:   createSimpleUrlDefinition(),
 			Group: environmentGroup,
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: "token"},
+				Token: &manifest.AuthSecret{Name: "token"},
 			},
 		},
 		environmentName2: manifest.EnvironmentDefinition{
@@ -651,7 +651,7 @@ func TestConvertConfigs(t *testing.T) {
 			URL:   createSimpleUrlDefinition(),
 			Group: environmentGroup2,
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: "token"},
+				Token: &manifest.AuthSecret{Name: "token"},
 			},
 		},
 	}
@@ -755,7 +755,7 @@ func TestConvertWithMissingName(t *testing.T) {
 			URL:   createSimpleUrlDefinition(),
 			Group: "development",
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: "token"},
+				Token: &manifest.AuthSecret{Name: "token"},
 			},
 		},
 	}
@@ -828,7 +828,7 @@ func TestConvertProjects(t *testing.T) {
 			URL:   createSimpleUrlDefinition(),
 			Group: environmentGroup,
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: "token"},
+				Token: &manifest.AuthSecret{Name: "token"},
 			},
 		},
 		environmentName2: manifest.EnvironmentDefinition{
@@ -836,7 +836,7 @@ func TestConvertProjects(t *testing.T) {
 			URL:   createSimpleUrlDefinition(),
 			Group: environmentGroup2,
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: "token"},
+				Token: &manifest.AuthSecret{Name: "token"},
 			},
 		},
 	}
@@ -1282,7 +1282,7 @@ func TestNewEnvironmentDefinitionFromV1(t *testing.T) {
 				URL:   newUrlDefinitionFromV1(tt.args.env),
 				Group: tt.args.group,
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{Name: tt.args.env.GetTokenName()},
+					Token: &manifest.AuthSecret{Name: tt.args.env.GetTokenName()},
 				},
 			}); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("NewEnvironmentDefinitionFromV1() = %v, want %v", got, tt.want)
@@ -1434,7 +1434,7 @@ func createEnvEnvironmentDefinition() manifest.EnvironmentDefinition {
 		},
 		Group: "group",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "NAME"},
+			Token: &manifest.AuthSecret{Name: "NAME"},
 		},
 	}
 }
@@ -1448,7 +1448,7 @@ func createValueEnvironmentDefinition() manifest.EnvironmentDefinition {
 		},
 		Group: "group",
 		Auth: manifest.Auth{
-			Token: manifest.AuthSecret{Name: "NAME"},
+			Token: &manifest.AuthSecret{Name: "NAME"},
 		},
 	}
 }
diff --git a/pkg/download/download_writer_test.go b/pkg/download/download_writer_test.go
index 0d263be95..227af1e32 100644
--- a/pkg/download/download_writer_test.go
+++ b/pkg/download/download_writer_test.go
@@ -170,7 +170,7 @@ func TestWriteToDisk(t *testing.T) {
 			proj := CreateProjectData(tt.args.downloadedConfigs, tt.args.projectName) //using CreateProject data to simplify test struct setup
 			writerContext := WriterContext{
 				ProjectToWrite: proj,
-				Auth: manifest.Auth{Token: manifest.AuthSecret{
+				Auth: manifest.Auth{Token: &manifest.AuthSecret{
 					Name: tt.args.tokenEnvVarName,
 				}},
 				EnvironmentUrl:  tt.args.environmentUrl,
@@ -229,7 +229,7 @@ func TestWriteToDisk_OverwritesManifestIfForced(t *testing.T) {
 	proj := CreateProjectData(downloadedConfigs, projectName) //using CreateProject data to simplify test struct setup
 	writerContext := WriterContext{
 		ProjectToWrite: proj,
-		Auth: manifest.Auth{Token: manifest.AuthSecret{
+		Auth: manifest.Auth{Token: &manifest.AuthSecret{
 			Name: tokenEnvVarName,
 		}},
 		EnvironmentUrl:  environmentUrl,
diff --git a/pkg/manifest/loader/manifest_loader_test.go b/pkg/manifest/loader/manifest_loader_test.go
index a3432ad7a..43aefe495 100644
--- a/pkg/manifest/loader/manifest_loader_test.go
+++ b/pkg/manifest/loader/manifest_loader_test.go
@@ -47,7 +47,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "TEST URL", Type: persistence.TypeValue},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			want: manifest.URLDefinition{
 				Type:  manifest.ValueURLType,
@@ -60,7 +60,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "TEST URL", Type: ""},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			want: manifest.URLDefinition{
 				Type:  manifest.ValueURLType,
@@ -73,7 +73,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "https://www.test.url/", Type: persistence.TypeValue},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			want: manifest.URLDefinition{
 				Type:  manifest.ValueURLType,
@@ -86,7 +86,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "TEST_TOKEN", Type: persistence.TypeEnvironment},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			givenEnvVarValue: "resolved url value",
 			want: manifest.URLDefinition{
@@ -101,7 +101,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "TEST_TOKEN", Type: persistence.TypeEnvironment},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			givenEnvVarValue: "https://www.test.url/",
 			want: manifest.URLDefinition{
@@ -116,7 +116,7 @@ func Test_extractUrlType(t *testing.T) {
 			inputConfig: persistence.Environment{
 				Name: "TEST ENV",
 				URL:  persistence.TypedValue{Value: "TEST URL", Type: "this-is-not-a-type"},
-				Auth: persistence.Auth{Token: persistence.AuthSecret{Type: "environment", Name: "VAR"}},
+				Auth: persistence.Auth{Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"}},
 			},
 			want:    manifest.URLDefinition{},
 			wantErr: true,
@@ -543,7 +543,7 @@ environmentGroups:
 										Value: "ENV_URL",
 									},
 									Auth: persistence.Auth{
-										Token: persistence.AuthSecret{
+										Token: &persistence.AuthSecret{
 											Name: "ENV_TOKEN",
 										},
 									},
@@ -588,7 +588,7 @@ environmentGroups:
 										Value: "https://www.dynatrace.com",
 									},
 									Auth: persistence.Auth{
-										Token: persistence.AuthSecret{
+										Token: &persistence.AuthSecret{
 											Name: "ENV_TOKEN",
 										},
 									},
@@ -725,11 +725,11 @@ func TestLoadManifest(t *testing.T) {
 	t.Setenv("ENV_OAUTH_ENDPOINT", "resolved-oauth-endpoint")
 
 	tests := []struct {
-		name            string
-		manifestContent string
-		groups          []string
-		envs            []string
-
+		name             string
+		manifestContent  string
+		groups           []string
+		envs             []string
+		number           int
 		errsContain      []string
 		expectedManifest manifest.Manifest
 	}{
@@ -761,7 +761,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -796,7 +796,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -810,7 +810,7 @@ environmentGroups:
 						},
 						Group: "groupB",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -847,7 +847,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -861,7 +861,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -897,7 +897,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -933,7 +933,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -971,7 +971,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -985,7 +985,7 @@ environmentGroups:
 						},
 						Group: "groupB",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1022,7 +1022,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1036,7 +1036,7 @@ environmentGroups:
 						},
 						Group: "groupB",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1073,7 +1073,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1087,7 +1087,7 @@ environmentGroups:
 						},
 						Group: "groupB",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1125,7 +1125,7 @@ environmentGroups:
 						},
 						Group: "groupA",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1139,7 +1139,7 @@ environmentGroups:
 						},
 						Group: "groupB",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "token-env-var",
 								Value: "mock token",
 							},
@@ -1229,7 +1229,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1275,7 +1275,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1350,7 +1350,7 @@ manifestVersion: 1.0
 projects: [{name: a}]
 environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {token: {name: ''}}} ]}]
 `,
-			errsContain: []string{"failed to parse Token and Oauth not set, token errors: empty"},
+			errsContain: []string{"failed to parse auth section: failed to parse token: no name given or empty"},
 		},
 		{
 			name: "Empty url",
@@ -1403,7 +1403,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1437,7 +1437,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1482,7 +1482,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1530,7 +1530,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1634,7 +1634,7 @@ manifestVersion: 1.0
 projects: [{name: a, path: p}]
 environmentGroups: [{name: b, environments: [{name: c, url: {value: d}}]}]
 `,
-			errsContain: []string{"failed to parse auth section"},
+			errsContain: []string{"no token or oauth provided in manifest"},
 		},
 		{
 			name: "Unknown type",
@@ -1669,7 +1669,7 @@ environmentGroups: [{name: b, environments: [{name: c, url: {type: environment,
 						},
 						Group: "b",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name:  "e",
 								Value: "mock token",
 							},
@@ -1754,27 +1754,30 @@ environmentGroups: [{name: b, environments: [{name: c, url: {value: d}, auth: {t
 		},
 	}
 	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			fs := afero.NewMemMapFs()
-			assert.NoError(t, afero.WriteFile(fs, "manifest.yaml", []byte(test.manifestContent), 0400))
+		if test.number == 1 {
 
-			mani, errs := Load(&Context{
-				Fs:           fs,
-				ManifestPath: "manifest.yaml",
-				Groups:       test.groups,
-				Environments: test.envs,
-			})
+			t.Run(test.name, func(t *testing.T) {
+				fs := afero.NewMemMapFs()
+				assert.NoError(t, afero.WriteFile(fs, "manifest.yaml", []byte(test.manifestContent), 0400))
+
+				mani, errs := Load(&Context{
+					Fs:           fs,
+					ManifestPath: "manifest.yaml",
+					Groups:       test.groups,
+					Environments: test.envs,
+				})
 
-			if len(errs) == len(test.errsContain) {
-				for i := range test.errsContain {
-					assert.ErrorContains(t, errs[i], test.errsContain[i])
+				if len(errs) == len(test.errsContain) {
+					for i := range test.errsContain {
+						assert.ErrorContains(t, errs[i], test.errsContain[i])
+					}
+				} else {
+					t.Errorf("Unexpected amount of errors: %#v", errs)
 				}
-			} else {
-				t.Errorf("Unexpected amount of errors: %#v", errs)
-			}
 
-			assert.Equal(t, test.expectedManifest, mani)
-		})
+				assert.Equal(t, test.expectedManifest, mani)
+			})
+		}
 	}
 }
 
@@ -1783,7 +1786,7 @@ func TestEnvVarResolutionCanBeDeactivated(t *testing.T) {
 		Name: "TEST ENV",
 		URL:  persistence.TypedValue{Value: "TEST_TOKEN", Type: persistence.TypeEnvironment},
 		Auth: persistence.Auth{
-			Token: persistence.AuthSecret{Type: "environment", Name: "VAR"},
+			Token: &persistence.AuthSecret{Type: "environment", Name: "VAR"},
 			OAuth: &persistence.OAuth{
 				ClientID:     persistence.AuthSecret{Type: "environment", Name: "VAR_1"},
 				ClientSecret: persistence.AuthSecret{Type: "environment", Name: "VAR_2"},
diff --git a/pkg/manifest/manifest_test.go b/pkg/manifest/manifest_test.go
index c040ab510..8aa347dfe 100644
--- a/pkg/manifest/manifest_test.go
+++ b/pkg/manifest/manifest_test.go
@@ -112,7 +112,7 @@ func TestManifestLoading(t *testing.T) {
 					Value: "https://some.url",
 				},
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{
+					Token: &manifest.AuthSecret{
 						Name:  "ENV_TOKEN",
 						Value: "dt01.token",
 					},
@@ -142,7 +142,7 @@ func TestManifestLoading(t *testing.T) {
 					Value: "https://ddd.bbb.cc",
 				},
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{
+					Token: &manifest.AuthSecret{
 						Name:  "ENV_TOKEN",
 						Value: "dt01.token",
 					},
@@ -158,7 +158,7 @@ func TestManifestLoading(t *testing.T) {
 					Value: "https://some.url",
 				},
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{
+					Token: &manifest.AuthSecret{
 						Name:  "ENV_TOKEN",
 						Value: "dt01.token",
 					},
diff --git a/pkg/manifest/writer/manifest_writer_test.go b/pkg/manifest/writer/manifest_writer_test.go
index 88fcafa1c..710eb96ae 100644
--- a/pkg/manifest/writer/manifest_writer_test.go
+++ b/pkg/manifest/writer/manifest_writer_test.go
@@ -161,7 +161,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 					},
 					Group: "group1",
 					Auth: manifest.Auth{
-						Token: manifest.AuthSecret{
+						Token: &manifest.AuthSecret{
 							Name: "TokenTest",
 						},
 					},
@@ -173,7 +173,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 					},
 					Group: "group1",
 					Auth: manifest.Auth{
-						Token: manifest.AuthSecret{},
+						Token: &manifest.AuthSecret{},
 						OAuth: &manifest.OAuth{
 							ClientID: manifest.AuthSecret{
 								Name:  "client-id-key",
@@ -198,7 +198,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 					},
 					Group: "group1",
 					Auth: manifest.Auth{
-						Token: manifest.AuthSecret{},
+						Token: &manifest.AuthSecret{},
 						OAuth: &manifest.OAuth{
 							ClientID: manifest.AuthSecret{
 								Name:  "client-id-key",
@@ -218,7 +218,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 					},
 					Group: "group1",
 					Auth: manifest.Auth{
-						Token: manifest.AuthSecret{},
+						Token: &manifest.AuthSecret{},
 						OAuth: &manifest.OAuth{
 							ClientID: manifest.AuthSecret{
 								Name:  "client-id-key",
@@ -242,7 +242,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 					},
 					Group: "group2",
 					Auth: manifest.Auth{
-						Token: manifest.AuthSecret{},
+						Token: &manifest.AuthSecret{},
 					},
 				},
 			},
@@ -254,7 +254,7 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 							Name: "env1",
 							URL:  persistence.TypedValue{Value: "www.an.Url"},
 							Auth: persistence.Auth{
-								Token: persistence.AuthSecret{
+								Token: &persistence.AuthSecret{
 									Name: "TokenTest",
 									Type: "environment",
 								},
@@ -264,7 +264,10 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 							Name: "env2",
 							URL:  persistence.TypedValue{Value: "www.an.Url"},
 							Auth: persistence.Auth{
-								Token: persistence.AuthSecret{},
+								Token: &persistence.AuthSecret{
+									Name: "env2_TOKEN",
+									Type: "environment",
+								},
 								OAuth: &persistence.OAuth{
 									ClientID: persistence.AuthSecret{
 										Type: persistence.TypeEnvironment,
@@ -285,7 +288,10 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 							Name: "env2a",
 							URL:  persistence.TypedValue{Value: "www.an.Url"},
 							Auth: persistence.Auth{
-								Token: persistence.AuthSecret{},
+								Token: &persistence.AuthSecret{
+									Name: "env2_TOKEN",
+									Type: "environment",
+								},
 								OAuth: &persistence.OAuth{
 									ClientID: persistence.AuthSecret{
 										Type: persistence.TypeEnvironment,
@@ -302,7 +308,10 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 							Name: "env2b",
 							URL:  persistence.TypedValue{Value: "www.an.Url"},
 							Auth: persistence.Auth{
-								Token: persistence.AuthSecret{},
+								Token: &persistence.AuthSecret{
+									Name: "env2_TOKEN",
+									Type: "environment",
+								},
 								OAuth: &persistence.OAuth{
 									ClientID: persistence.AuthSecret{
 										Type: persistence.TypeEnvironment,
@@ -327,7 +336,10 @@ func Test_toWriteableEnvironmentGroups(t *testing.T) {
 							Name: "env3",
 							URL:  persistence.TypedValue{Value: "www.an.Url"},
 							Auth: persistence.Auth{
-								Token: persistence.AuthSecret{},
+								Token: &persistence.AuthSecret{
+									Name: "env3_TOKEN",
+									Type: "environment",
+								},
 							},
 						},
 					},
@@ -421,7 +433,7 @@ func Test_toWritableToken(t *testing.T) {
 				URL:   manifest.URLDefinition{},
 				Group: "GROUP",
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{Name: "VARIABLE"},
+					Token: &manifest.AuthSecret{Name: "VARIABLE"},
 				},
 			},
 			persistence.AuthSecret{
@@ -437,15 +449,18 @@ func Test_toWritableToken(t *testing.T) {
 				Group: "GROUP",
 
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{},
+					Token: &manifest.AuthSecret{},
 				},
 			},
-			persistence.AuthSecret{},
+			persistence.AuthSecret{
+				Name: "NAME_TOKEN",
+				Type: "environment",
+			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := getTokenSecret(tt.input.Auth, tt.input.Name); !reflect.DeepEqual(got, tt.want) {
+			if got := getTokenSecret(tt.input.Auth, tt.input.Name); !reflect.DeepEqual(got, &tt.want) {
 				t.Errorf("getTokenSecret() = %v, want %v", got, tt.want)
 			}
 		})
@@ -581,7 +596,7 @@ func TestWrite(t *testing.T) {
 						},
 						Group: "group1",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name: "TOKEN_VAR",
 							},
 						},
@@ -621,7 +636,7 @@ environmentGroups:
 						},
 						Group: "group1",
 						Auth: manifest.Auth{
-							Token: manifest.AuthSecret{
+							Token: &manifest.AuthSecret{
 								Name: "TOKEN_VAR",
 							},
 						},
diff --git a/pkg/persistence/config/loader/config_loader_test.go b/pkg/persistence/config/loader/config_loader_test.go
index b97c33bdc..0a3470a42 100644
--- a/pkg/persistence/config/loader/config_loader_test.go
+++ b/pkg/persistence/config/loader/config_loader_test.go
@@ -53,7 +53,7 @@ func Test_parseConfigs(t *testing.T) {
 				URL:   manifest.URLDefinition{Type: manifest.ValueURLType, Value: "env url"},
 				Group: "default",
 				Auth: manifest.Auth{
-					Token: manifest.AuthSecret{Name: "token var"},
+					Token: &manifest.AuthSecret{Name: "token var"},
 				},
 			},
 		},
diff --git a/pkg/project/v2/project_loader_test.go b/pkg/project/v2/project_loader_test.go
index 5d93817e0..4d785451b 100644
--- a/pkg/project/v2/project_loader_test.go
+++ b/pkg/project/v2/project_loader_test.go
@@ -668,7 +668,7 @@ func getFullProjectLoaderContext(apis []string, projects []string, environments
 		envDefinitions[e] = manifest.EnvironmentDefinition{
 			Name: e,
 			Auth: manifest.Auth{
-				Token: manifest.AuthSecret{Name: fmt.Sprintf("%s_VAR", e)},
+				Token: &manifest.AuthSecret{Name: fmt.Sprintf("%s_VAR", e)},
 			},
 		}
 	}
@@ -770,7 +770,7 @@ func TestLoadProjects_Simple(t *testing.T) {
 			Environments: manifest.Environments{
 				"default": {
 					Name: "default",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -872,7 +872,7 @@ func TestLoadProjects_Groups(t *testing.T) {
 			Environments: manifest.Environments{
 				"default": {
 					Name: "default",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -992,11 +992,11 @@ func TestLoadProjects_WithEnvironmentOverrides(t *testing.T) {
 			Environments: manifest.Environments{
 				"dev": {
 					Name: "dev",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 				"prod": {
 					Name: "prod",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -1110,7 +1110,7 @@ func TestLoadProjects_WithEnvironmentOverridesAndLimitedEnvironments(t *testing.
 			Environments: manifest.Environments{
 				"dev": {
 					Name: "dev",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -1174,7 +1174,7 @@ func TestLoadProjects_IgnoresIrrelevantProjectWithErrors(t *testing.T) {
 			Environments: manifest.Environments{
 				"dev": {
 					Name: "dev",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -1271,7 +1271,7 @@ func TestLoadProjects_DeepDependencies(t *testing.T) {
 			Environments: manifest.Environments{
 				"default": {
 					Name: "default",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},
@@ -1349,7 +1349,7 @@ func TestLoadProjects_CircularDependencies(t *testing.T) {
 			Environments: manifest.Environments{
 				"default": {
 					Name: "default",
-					Auth: manifest.Auth{Token: manifest.AuthSecret{Name: "ENV_VAR"}},
+					Auth: manifest.Auth{Token: &manifest.AuthSecret{Name: "ENV_VAR"}},
 				},
 			},
 		},