OK, reading my own question after i solved this problem is kind of embarrassing, given how easy the solution is. I fell in the X-Y problem trap.
I始m doing OAuth2 here. That means different consumers of the API (api.example.com) can, and actually should have different access tokens, all obtained from the authorisation server (auth.example.com).
I始m glad this question didn始t get too much exposure 馃榿