In case anyone else struggles, decrypting token is very much like decrypting user but need appropriate block size and -post.