Auth: obtain access token from  app credentials

Yes, it seems to make the difference from `400 Bad Request` to `200`.