add comment about generating a access token with app id and app secret