User can be nil in case of app tokens