we need the access token, too