access token, auth code and client schemas