Make clientId and secret optional on token