anchor.diff:                  ok
           end,
   
  -        {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
  -        {ok, IssuerUrl} = application:get_env(?APP_Name, openid_issuer_url),
  -
  -        {ok, #user{name = Name, email_list = Emails}} = user_logic:get_user(UserId),
  -        {ok, [
  -            {access_token, AccessToken},
  -            {token_type, bearer},
  -            {expires_in, AccessExpirationSecs},
  -            {refresh_token, RefreshToken},
  -            {scope, openid},
  -            {id_token, jwt_encode([
  -                {iss, vcn_utils:ensure_binary(IssuerUrl)},
  -                {sub, UserId},
  -                {aud, Audience},
  -                {name, Name},
  -                {emails, Emails},
  -                {exp, ExpirationTime},
  -                {iat, Now}
  -            ])}
  -        ]}
  +        prepare_token_response(UserId, ProviderId, AccessToken, RefreshToken, ExpirationTime, Now)
       catch
           Error -> {error, Error}
       end.
  
positive.code: 
          {ok, _} = ?DB(save_access, AccessDocUpdated),
  
          {ok, AccessExpirationSecs} = application:get_env(?APP_Name, access_token_expiration_seconds),
  
          {ok, [
              {access_token, AccessToken},
              {token_type, bearer},
              {expires_in, AccessExpirationSecs},
              {refresh_token, RefreshTokenNew},
              {scope, openid}
          ]}
      catch
          Error -> {error, Error}
      end.
  
negative.code:         end,
  
          #veil_document{record = Access} = AccessDoc,
          #access{provider_id = ProviderId, user_id = UserId} = Access,
  
          case Client of
              {provider, ProviderId} -> ok;
  