access token is internal to LK.. so not sure if it's a good idea to expose the claims in there to clients