Properly sign request when fetching access token