Be able to operate on access tokens, without API keys.