retrieve access token directly