private function extractAccessToken(ServerRequestInterface $request)
    {
        // The preferred way is using Authorization header
        if ($request->hasHeader('Authorization')) {
            // Header value is expected to be "Bearer xxx"
            $parts = explode(' ', $request->getHeaderLine('Authorization'));

            if (count($parts) < 2) {
                return null;
            }

            return end($parts);
        }

        // Default back to authorization in query param
        $queryParams = $request->getQueryParams();

        return $queryParams['access_token'] ?? null;
    }