save tokens to file, env vars for client key and secret