anchor.diff:                  ok
           end,
   
  -        {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
  -        {ok, IssuerUrl} = application:get_env(?APP_Name, openid_issuer_url),
  -
  -        {ok, #user{name = Name, email_list = Emails}} = user_logic:get_user(UserId),
  -        {ok, [
  -            {access_token, AccessToken},
  -            {token_type, bearer},
  -            {expires_in, AccessExpirationSecs},
  -            {refresh_token, RefreshToken},
  -            {scope, openid},
  -            {id_token, jwt_encode([
  -                {iss, vcn_utils:ensure_binary(IssuerUrl)},
  -                {sub, UserId},
  -                {aud, Audience},
  -                {name, Name},
  -                {emails, Emails},
  -                {exp, ExpirationTime},
  -                {iat, Now}
  -            ])}
  -        ]}
  +        prepare_token_response(UserId, ProviderId, AccessToken, RefreshToken, ExpirationTime, Now)
       catch
           Error -> {error, Error}
       end.
  
positive.code:         end,
  
          ok = ?DB(remove_authorization, AuthId),
  
          Audience = case ProviderId of
              undefined -> UserId;
              _ -> ProviderId
          end,
  
          case Client of %% poor man's validation
              {provider, ProviderId} -> ok;
  
negative.code:     #veil_document{uuid = AccessId, record = Access} = AccessDoc,
      ?alert("Revoking access id: ~p, contents: ~p", [AccessId, Access]),
      ok = ?DB(remove_access, AccessId).
  
  
  %% prepare_token_response/1
  %% ====================================================================
  %% @doc Prepares an OpenID token response to encode into JSON.
  %% ====================================================================
  -spec prepare_token_response(UserId :: binary(), ProviderId :: binary(),
      AccessToken :: binary(), RefreshToken :: binary(),
      ExpirationTime :: non_neg_integer(), Now :: non_neg_integer()) ->
      proplists:proplist().
  %% ====================================================================
  prepare_token_response(UserId, ProviderId, AccessToken, RefreshToken, ExpirationTime, Now) ->
      {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
      {ok, IssuerUrl} = application:get_env(?APP_Name, openid_issuer_url),
  
      Audience = case ProviderId of
          undefined -> UserId;
          _ -> ProviderId
      end,
  
      {ok, #user{name = Name, email_list = Emails}} = user_logic:get_user(UserId),
      {ok, [
          {access_token, AccessToken},
          {token_type, bearer},
          {expires_in, AccessExpirationSecs},
          {refresh_token, RefreshToken},
          {scope, openid},
          {id_token, jwt_encode([
              {iss, vcn_utils:ensure_binary(IssuerUrl)},
              {sub, UserId},
              {aud, Audience},
              {name, Name},
              {emails, Emails},
              {exp, ExpirationTime},
              {iat, Now}
          ])}
      ]}.
  