Decoupled access token handling