do not throw an exception when token or secret are missing
the authorization url is provided in the response, no need to generate