use access tokens properly