3. Authorization and Token Generation