Action Flow AccessToken empty on onExecutePostLogin

Ok, I understand but I do need to be able to call my api during the flow, how do I protect those endpoints?