So all APIs except for /refresh need sAccessToken and sIdRefreshToken. sIdRefreshToken by doesn’t give access to anything. So mainly sAccessToken is the critical token here