access_token query param is in JWT format