Auth: obtain access token from  app credentials