get access token from client side