work on oauth and bearer tokens