Token: Don't expose getKey and getSecret; clients should never need them separated out.