Require appID and secret, fix call to cached token