Auth: obtain access token from  app credentials

Build the hash before, and only call .send once