diff --git a/src/privet/auth_manager.cc b/src/privet/auth_manager.cc
index 61f5a09..8df7e13 100644
--- a/src/privet/auth_manager.cc
+++ b/src/privet/auth_manager.cc
@@ -4,6 +4,7 @@
 
 #include "src/privet/auth_manager.h"
 
+#include <base/guid.h>
 #include <base/rand_util.h>
 #include <base/strings/string_number_conversions.h>
 
@@ -211,13 +212,13 @@
 bool AuthManager::ConfirmClientAuthToken(const std::vector<uint8_t>& token,
                                          ErrorPtr* error) {
   // Cover case when caller sent confirm twice.
-  if (pending_claims_.empty() && IsValidAuthToken(token))
-    return true;
+  if (pending_claims_.empty())
+    return IsValidAuthToken(token, error);
 
   auto claim =
       std::find_if(pending_claims_.begin(), pending_claims_.end(),
                    [&token](const decltype(pending_claims_)::value_type& auth) {
-                     return auth.first->IsValidAuthToken(token);
+                     return auth.first->IsValidAuthToken(token, nullptr);
                    });
   if (claim == pending_claims_.end()) {
     Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kNotFound,
@@ -256,17 +257,55 @@
   return clock_->Now();
 }
 
-bool AuthManager::IsValidAuthToken(const std::vector<uint8_t>& token) const {
+bool AuthManager::IsValidAuthToken(const std::vector<uint8_t>& token,
+                                   ErrorPtr* error) const {
   std::vector<uint8_t> buffer(kMaxMacaroonSize);
   UwMacaroon macaroon{};
   if (!uw_macaroon_load_(token.data(), token.size(), buffer.data(),
                          buffer.size(), &macaroon)) {
+    Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kInvalidAuthCode,
+                 "Invalid token format");
     return false;
   }
 
   CHECK_EQ(kSha256OutputSize, auth_secret_.size());
-  return uw_macaroon_verify_(&macaroon, auth_secret_.data(),
-                             auth_secret_.size());
+  if (!uw_macaroon_verify_(&macaroon, auth_secret_.data(),
+                           auth_secret_.size())) {
+    Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kInvalidAuthCode,
+                 "Invalid token signature");
+    return false;
+  }
+  return true;
+}
+
+bool AuthManager::CreateAccessTokenFromAuth(
+    const std::vector<uint8_t>& auth_token,
+    base::TimeDelta ttl,
+    std::vector<uint8_t>* access_token,
+    AuthScope* access_token_scope,
+    base::TimeDelta* access_token_ttl,
+    ErrorPtr* error) const {
+  // TODO(vitalybuka): implement token validation.
+  if (!IsValidAuthToken(auth_token, error))
+    return false;
+
+  if (!access_token)
+    return true;
+
+  // TODO(vitalybuka): User and scope must be parsed from auth_token.
+  UserInfo info{config_ ? config_->GetSettings().local_anonymous_access_role
+                        : AuthScope::kViewer,
+                base::GenerateGUID()};
+
+  // TODO(vitalybuka): TTL also should be reduced in accordance with auth_token.
+  *access_token = CreateAccessToken(info, ttl);
+
+  if (access_token_scope)
+    *access_token_scope = info.scope();
+
+  if (access_token_ttl)
+    *access_token_ttl = ttl;
+  return true;
 }
 
 std::vector<uint8_t> AuthManager::CreateSessionId() {
diff --git a/src/privet/auth_manager.h b/src/privet/auth_manager.h
index 00d6e32..6a403b4 100644
--- a/src/privet/auth_manager.h
+++ b/src/privet/auth_manager.h
@@ -55,7 +55,14 @@
                               ErrorPtr* error);
 
   std::vector<uint8_t> GetRootClientAuthToken() const;
-  bool IsValidAuthToken(const std::vector<uint8_t>& token) const;
+  bool IsValidAuthToken(const std::vector<uint8_t>& token,
+                        ErrorPtr* error) const;
+  bool CreateAccessTokenFromAuth(const std::vector<uint8_t>& auth_token,
+                                 base::TimeDelta ttl,
+                                 std::vector<uint8_t>* access_token,
+                                 AuthScope* access_token_scope,
+                                 base::TimeDelta* access_token_ttl,
+                                 ErrorPtr* error) const;
 
   void SetAuthSecret(const std::vector<uint8_t>& secret,
                      RootClientTokenOwner owner);
diff --git a/src/privet/auth_manager_unittest.cc b/src/privet/auth_manager_unittest.cc
index 137e046..ce142c0 100644
--- a/src/privet/auth_manager_unittest.cc
+++ b/src/privet/auth_manager_unittest.cc
@@ -122,7 +122,6 @@
 
     auto token = auth.CreateAccessToken(UserInfo{AuthScope::kUser, "5"},
                                         base::TimeDelta::FromSeconds(i));
-    base::Time time2;
     UserInfo user_info;
     EXPECT_FALSE(auth_.ParseAccessToken(token, &user_info, nullptr));
     EXPECT_TRUE(auth.ParseAccessToken(token, &user_info, nullptr));
@@ -159,14 +158,14 @@
 }
 
 TEST_F(AuthManagerTest, IsValidAuthToken) {
-  EXPECT_TRUE(auth_.IsValidAuthToken(auth_.GetRootClientAuthToken()));
+  EXPECT_TRUE(auth_.IsValidAuthToken(auth_.GetRootClientAuthToken(), nullptr));
   // Multiple attempts with random secrets.
   for (size_t i = 0; i < 1000; ++i) {
     AuthManager auth{{}, {}, {}, &clock_};
 
     auto token = auth.GetRootClientAuthToken();
-    EXPECT_FALSE(auth_.IsValidAuthToken(token));
-    EXPECT_TRUE(auth.IsValidAuthToken(token));
+    EXPECT_FALSE(auth_.IsValidAuthToken(token, nullptr));
+    EXPECT_TRUE(auth.IsValidAuthToken(token, nullptr));
   }
 }
 
@@ -211,12 +210,12 @@
 TEST_F(AuthManagerClaimTest, NormalClaim) {
   auto token =
       auth_.ClaimRootClientAuthToken(RootClientTokenOwner::kCloud, nullptr);
-  EXPECT_FALSE(auth_.IsValidAuthToken(token));
+  EXPECT_FALSE(auth_.IsValidAuthToken(token, nullptr));
   EXPECT_EQ(RootClientTokenOwner::kNone,
             config_.GetSettings().root_client_token_owner);
 
   EXPECT_TRUE(auth_.ConfirmClientAuthToken(token, nullptr));
-  EXPECT_TRUE(auth_.IsValidAuthToken(token));
+  EXPECT_TRUE(auth_.IsValidAuthToken(token, nullptr));
   EXPECT_EQ(RootClientTokenOwner::kCloud,
             config_.GetSettings().root_client_token_owner);
 }
@@ -245,5 +244,18 @@
   EXPECT_FALSE(auth_.ConfirmClientAuthToken(token, nullptr));
 }
 
+TEST_F(AuthManagerClaimTest, CreateAccessTokenFromAuth) {
+  std::vector<uint8_t> access_token;
+  AuthScope scope;
+  base::TimeDelta ttl;
+  EXPECT_TRUE(auth_.CreateAccessTokenFromAuth(
+      auth_.GetRootClientAuthToken(), base::TimeDelta::FromDays(1),
+      &access_token, &scope, &ttl, nullptr));
+  UserInfo user_info;
+  EXPECT_TRUE(auth_.ParseAccessToken(access_token, &user_info, nullptr));
+  EXPECT_EQ(scope, user_info.scope());
+  EXPECT_FALSE(user_info.user_id().empty());
+}
+
 }  // namespace privet
 }  // namespace weave
diff --git a/src/privet/security_manager.cc b/src/privet/security_manager.cc
index bc8dc4f..caed476 100644
--- a/src/privet/security_manager.cc
+++ b/src/privet/security_manager.cc
@@ -111,23 +111,50 @@
     ClosePendingSession(pending_sessions_.begin()->first);
 }
 
-bool SecurityManager::CreateAccessToken(AuthType auth_type,
-                                        const std::string& auth_code,
-                                        AuthScope desired_scope,
-                                        std::string* access_token,
-                                        AuthScope* access_token_scope,
-                                        base::TimeDelta* access_token_ttl,
-                                        ErrorPtr* error) {
+bool SecurityManager::CreateAccessTokenImpl(AuthType auth_type,
+                                            AuthScope desired_scope,
+                                            std::vector<uint8_t>* access_token,
+                                            AuthScope* access_token_scope,
+                                            base::TimeDelta* access_token_ttl) {
+  UserInfo user_info{desired_scope,
+                     std::to_string(static_cast<int>(auth_type)) + "/" +
+                         std::to_string(++last_user_id_)};
+
+  const base::TimeDelta kTtl =
+      base::TimeDelta::FromSeconds(kAccessTokenExpirationSeconds);
+
+  if (access_token)
+    *access_token = auth_manager_->CreateAccessToken(user_info, kTtl);
+
+  if (access_token_scope)
+    *access_token_scope = user_info.scope();
+
+  if (access_token_ttl)
+    *access_token_ttl = kTtl;
+
+  return true;
+}
+
+bool SecurityManager::CreateAccessTokenImpl(
+    AuthType auth_type,
+    const std::vector<uint8_t>& auth_code,
+    AuthScope desired_scope,
+    std::vector<uint8_t>* access_token,
+    AuthScope* access_token_scope,
+    base::TimeDelta* access_token_ttl,
+    ErrorPtr* error) {
   auto disabled_mode = [](ErrorPtr* error) {
     Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kInvalidAuthMode,
                  "Mode is not available");
     return false;
   };
+
   switch (auth_type) {
     case AuthType::kAnonymous:
       if (!auth_manager_->IsAnonymousAuthSupported())
         return disabled_mode(error);
-      break;
+      return CreateAccessTokenImpl(auth_type, desired_scope, access_token,
+                                   access_token_scope, access_token_ttl);
     case AuthType::kPairing:
       if (!auth_manager_->IsPairingAuthSupported())
         return disabled_mode(error);
@@ -136,34 +163,45 @@
                      errors::kInvalidAuthCode, "Invalid authCode");
         return false;
       }
-      break;
+      return CreateAccessTokenImpl(auth_type, desired_scope, access_token,
+                                   access_token_scope, access_token_ttl);
     case AuthType::kLocal:
       if (!auth_manager_->IsLocalAuthSupported())
         return disabled_mode(error);
-      NOTIMPLEMENTED();
-      // no break to fall back to default.
-    default:
-      Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kInvalidAuthMode,
-                   "Unsupported auth mode");
-      return false;
+      const base::TimeDelta kTtl =
+          base::TimeDelta::FromSeconds(kAccessTokenExpirationSeconds);
+      return auth_manager_->CreateAccessTokenFromAuth(
+          auth_code, kTtl, access_token, access_token_scope, access_token_ttl,
+          error);
   }
 
-  UserInfo user_info{desired_scope,
-                     std::to_string(static_cast<int>(auth_type)) + "/" +
-                         std::to_string(++last_user_id_)};
-  base::TimeDelta ttl =
-      base::TimeDelta::FromSeconds(kAccessTokenExpirationSeconds);
+  Error::AddTo(error, FROM_HERE, errors::kDomain, errors::kInvalidAuthMode,
+               "Unsupported auth mode");
+  return false;
+}
 
-  if (access_token) {
-    *access_token =
-        Base64Encode(auth_manager_->CreateAccessToken(user_info, ttl));
+bool SecurityManager::CreateAccessToken(AuthType auth_type,
+                                        const std::string& auth_code,
+                                        AuthScope desired_scope,
+                                        std::string* access_token,
+                                        AuthScope* access_token_scope,
+                                        base::TimeDelta* access_token_ttl,
+                                        ErrorPtr* error) {
+  std::vector<uint8_t> auth_decoded;
+  if (auth_type != AuthType::kAnonymous &&
+      !Base64Decode(auth_code, &auth_decoded)) {
+    return false;
   }
 
-  if (access_token_scope)
-    *access_token_scope = user_info.scope();
+  std::vector<uint8_t> access_token_decoded;
+  if (!CreateAccessTokenImpl(auth_type, auth_decoded, desired_scope,
+                             &access_token_decoded, access_token_scope,
+                             access_token_ttl, error)) {
+    return false;
+  }
 
-  if (access_token_ttl)
-    *access_token_ttl = ttl;
+  if (access_token)
+    *access_token = Base64Encode(access_token_decoded);
 
   return true;
 }
@@ -224,18 +262,15 @@
   return auth_manager_->ConfirmClientAuthToken(token_decoded, error);
 }
 
-bool SecurityManager::IsValidPairingCode(const std::string& auth_code) const {
+bool SecurityManager::IsValidPairingCode(
+    const std::vector<uint8_t>& auth_code) const {
   if (is_security_disabled_)
     return true;
-  std::vector<uint8_t> auth_decoded;
-  if (!Base64Decode(auth_code, &auth_decoded))
-    return false;
   for (const auto& session : confirmed_sessions_) {
     const std::string& key = session.second->GetKey();
     const std::string& id = session.first;
-    if (auth_decoded ==
-        HmacSha256(std::vector<uint8_t>(key.begin(), key.end()),
-                   std::vector<uint8_t>(id.begin(), id.end()))) {
+    if (auth_code == HmacSha256(std::vector<uint8_t>(key.begin(), key.end()),
+                                std::vector<uint8_t>(id.begin(), id.end()))) {
       pairing_attemts_ = 0;
       block_pairing_until_ = base::Time{};
       return true;
diff --git a/src/privet/security_manager.h b/src/privet/security_manager.h
index 5cb884f..79abf33 100644
--- a/src/privet/security_manager.h
+++ b/src/privet/security_manager.h
@@ -64,8 +64,8 @@
                          const std::string& auth_code,
                          AuthScope desired_scope,
                          std::string* access_token,
-                         AuthScope* granted_scope,
-                         base::TimeDelta* ttl,
+                         AuthScope* access_token_scope,
+                         base::TimeDelta* access_token_ttl,
                          ErrorPtr* error) override;
   bool ParseAccessToken(const std::string& token,
                         UserInfo* user_info,
@@ -94,12 +94,24 @@
                                 const PairingEndListener& on_end);
 
  private:
-  bool IsValidPairingCode(const std::string& auth_code) const;
+  bool IsValidPairingCode(const std::vector<uint8_t>& auth_code) const;
   FRIEND_TEST_ALL_PREFIXES(SecurityManagerTest, ThrottlePairing);
   // Allows limited number of new sessions without successful authorization.
   bool CheckIfPairingAllowed(ErrorPtr* error);
   bool ClosePendingSession(const std::string& session_id);
   bool CloseConfirmedSession(const std::string& session_id);
+  bool CreateAccessTokenImpl(AuthType auth_type,
+                             const std::vector<uint8_t>& auth_code,
+                             AuthScope desired_scope,
+                             std::vector<uint8_t>* access_token,
+                             AuthScope* access_token_scope,
+                             base::TimeDelta* access_token_ttl,
+                             ErrorPtr* error);
+  bool CreateAccessTokenImpl(AuthType auth_type,
+                             AuthScope desired_scope,
+                             std::vector<uint8_t>* access_token,
+                             AuthScope* access_token_scope,
+                             base::TimeDelta* access_token_ttl);
 
   AuthManager* auth_manager_{nullptr};