service account token extraction