save the access token from step 3, not step 1