Auth: obtain access token from credentials