oauth2 way of creating a token