get access token. whether or not using callbackUrl