How would you authenticate requests for player specific data in a server authoritative game?

Question

I am creating a server authoritative game that uses a public game service API to manage player specific data in the game. The client will authenticate with the auth server, get a token, then use that token to access player specific data in the API. This works well if the API calls to the game services occur on the game client. However, in a server authoritative model, the game server itself would need to make those calls on behalf of the client. My current idea is to replicate the access token to the server and then have the server figure out which token to use when it is requesting data for a specific client. I was curious if this is the best way to do this or is there another approach I should be considering?