I'm probably missing a bit of background on oauth. I expected this token to be based on the project key and secret.