it needs access_token for all cases