Don't actually need a full access token, a client_id suffices and is not ephemeral