And I think it's fine to pass client_id together with access_token?
If so, I am currently making it always attach client_id, and attach
access_token only if it's available.