diff --git a/clients.go b/clients.go
index c260b98..7fc8c48 100644
--- a/clients.go
+++ b/clients.go
@@ -1,15 +1,19 @@
 package apiGatewayConfDeploy
 
 import (
+	"github.com/30x/apid-core"
+	"github.com/30x/apidApigeeSync"
 	"io/ioutil"
 	"net/http"
 	"net/url"
+	"strings"
 )
 
 const (
 	trackerConfigStatusEndpoint = "/serviceconfigstatus"
 	trackerHeartbeatEndpoint    = "/serviceheartbeat/{uuid}"
 	trackerRegisterEndpoint     = "/serviceregister/{uuid}"
+	ApigeeSyncTokenSelector     = "ApigeeSyncToken"
 )
 
 type trackerClientInterface interface {
@@ -28,17 +32,18 @@
 	trackerBaseUrl string
 	clusterId      string
 	httpclient     *http.Client
+	handler        *tokenEventHandler
 }
 
 func (t *trackerClient) putConfigStatus(configId, status, uuid, created string) trackerResponse {
-	uri, err := url.Parse(t.trackerBaseUrl + trackerConfigStatusEndpoint)
+	uri, err := url.Parse(t.trackerBaseUrl + strings.Replace(trackerConfigStatusEndpoint, "{uuid}", uuid, 1))
 	if err != nil {
 		log.Errorf("putConfigStatus failed to parse tracker uri: %v", err)
 		return (internalError(err))
 	}
-	req, err := http.NewRequest("PUT", uri, nil)
+	req, err := http.NewRequest("PUT", uri.String(), nil)
 	req.Header.Add("configid", configId)
-	req.Header.Add("Authorization", getAuthToken())
+	req.Header.Add("Authorization", t.handler.getBearerToken())
 	req.Header.Add("status", status)
 	req.Header.Add("uuid", uuid)
 	req.Header.Add("created", created)
@@ -55,8 +60,16 @@
 	case http.StatusOK:
 		res.code = r.StatusCode
 		res.contentType = r.Header.Get("Content-type")
+	case http.StatusUnauthorized, http.StatusForbidden:
+		res.code = http.StatusInternalServerError
+		res.errString = "apid token rejected by tracker"
+		return res
 	default:
-		res.code = r.StatusCode
+		if 400 <= res.code && res.code < 500 {
+			res.code = http.StatusInternalServerError
+		} else {
+			res.code = r.StatusCode
+		}
 		res.contentType = r.Header.Get("Content-type")
 		body, err := ioutil.ReadAll(r.Body)
 		if err != nil {
@@ -68,14 +81,13 @@
 }
 
 func (t *trackerClient) postRegister(uuid, pod, created, name, podType, serviceType string) trackerResponse {
-	uri, err := url.Parse(t.trackerBaseUrl + trackerRegisterEndpoint)
+	uri, err := url.Parse(t.trackerBaseUrl + strings.Replace(trackerRegisterEndpoint, "{uuid}", uuid, 1))
 	if err != nil {
 		log.Errorf("postRegister failed to parse tracker uri: %v", err)
 		return (internalError(err))
 	}
-	req, err := http.NewRequest("PUT", uri, nil)
-	req.Header.Add("uuid", uuid)
-	req.Header.Add("Authorization", getAuthToken())
+	req, err := http.NewRequest("PUT", uri.String(), nil)
+	req.Header.Add("Authorization", t.handler.getBearerToken())
 	req.Header.Add("pod", pod)
 	req.Header.Add("podtype", podType)
 	req.Header.Add("created", created)
@@ -94,8 +106,16 @@
 	case http.StatusOK:
 		res.code = r.StatusCode
 		res.contentType = r.Header.Get("Content-type")
+	case http.StatusUnauthorized, http.StatusForbidden:
+		res.code = http.StatusInternalServerError
+		res.errString = "apid token rejected by tracker"
+		return res
 	default:
-		res.code = r.StatusCode
+		if 400 <= res.code && res.code < 500 {
+			res.code = http.StatusInternalServerError
+		} else {
+			res.code = r.StatusCode
+		}
 		res.contentType = r.Header.Get("Content-type")
 		body, err := ioutil.ReadAll(r.Body)
 		if err != nil {
@@ -107,21 +127,20 @@
 }
 
 func (t *trackerClient) putHeartbeat(uuid, updated string) trackerResponse {
-	uri, err := url.Parse(t.trackerBaseUrl + trackerHeartbeatEndpoint)
+	uri, err := url.Parse(t.trackerBaseUrl + strings.Replace(trackerHeartbeatEndpoint, "{uuid}", uuid, 1))
 	if err != nil {
 		log.Errorf("putHeartbeat failed to parse tracker uri: %v", err)
-		return (internalError(err))
+		return internalError(err)
 	}
-	req, err := http.NewRequest("PUT", uri, nil)
-	req.Header.Add("uuid", uuid)
-	req.Header.Add("Authorization", getAuthToken())
+	req, err := http.NewRequest("PUT", uri.String(), nil)
+	req.Header.Add("Authorization", t.handler.getBearerToken())
 	req.Header.Add("updated", updated)
 	req.Header.Add("clusterid", t.clusterId)
 
 	r, err := t.httpclient.Do(req)
 	if err != nil {
 		log.Errorf("trackerClient communication error: %v", err)
-		return (internalError(err))
+		return internalError(err)
 	}
 	defer r.Body.Close()
 	res := trackerResponse{}
@@ -129,12 +148,20 @@
 	case http.StatusOK:
 		res.code = r.StatusCode
 		res.contentType = r.Header.Get("Content-type")
+	case http.StatusUnauthorized, http.StatusForbidden:
+		res.code = http.StatusInternalServerError
+		res.errString = "apid token rejected by tracker"
+		return res
 	default:
-		res.code = r.StatusCode
+		if 400 <= res.code && res.code < 500 {
+			res.code = http.StatusInternalServerError
+		} else {
+			res.code = r.StatusCode
+		}
 		res.contentType = r.Header.Get("Content-type")
 		body, err := ioutil.ReadAll(r.Body)
 		if err != nil {
-			return (internalError(err))
+			return internalError(err)
 		}
 		res.errString = string(body)
 	}
@@ -147,7 +174,21 @@
 	return res
 }
 
-func getAuthToken() string {
-	//TODO
-	return "Bearer "
+type tokenEventHandler struct {
+	token string
+}
+
+func (h *tokenEventHandler) Handle(e apid.Event) {
+	if tokenEvent, ok := e.(*apidApigeeSync.TokenEvent); ok {
+		h.token = tokenEvent.AccessToken
+	}
+}
+
+func (h *tokenEventHandler) getBearerToken() string {
+	return "Bearer " + h.token
+}
+
+func (h *tokenEventHandler) initListener(services apid.Services) {
+
+	services.Events().Listen(ApigeeSyncTokenSelector, h)
 }
diff --git a/init.go b/init.go
index 919e7a6..b1d2b7c 100644
--- a/init.go
+++ b/init.go
@@ -129,6 +129,29 @@
 	}
 	apidClusterId = config.GetString(configApidClusterID)
 
+	// initialize token handler
+
+	tokenHandler := &tokenEventHandler{}
+	tokenHandler.initListener(services)
+
+	// initialize tracker client
+
+	client := &trackerClient{
+		trackerBaseUrl: configApiServerBaseURI,
+		clusterId:      apidClusterId,
+		httpclient: &http.Client{
+			Transport: &http.Transport{
+				MaxIdleConnsPerHost: maxIdleConnsPerHost,
+			},
+			Timeout: httpTimeout,
+			CheckRedirect: func(req *http.Request, _ []*http.Request) error {
+				req.Header.Set("Authorization", tokenHandler.getBearerToken())
+				return nil
+			},
+		},
+		handler: tokenHandler,
+	}
+
 	// initialize db manager
 
 	dbMan := &dbManager{
@@ -139,14 +162,18 @@
 	// initialize api manager
 
 	apiMan := &apiManager{
-		dbMan:               dbMan,
-		deploymentsEndpoint: deploymentsEndpoint,
-		blobEndpoint:        blobEndpoint,
-		eTag:                0,
-		deploymentsChanged:  make(chan interface{}, 5),
-		addSubscriber:       make(chan chan deploymentsResult),
-		removeSubscriber:    make(chan chan deploymentsResult),
-		apiInitialized:      false,
+		dbMan:                dbMan,
+		trackerCl:            client,
+		deploymentsEndpoint:  deploymentsEndpoint,
+		blobEndpoint:         blobEndpoint,
+		configStatusEndpoint: configStatusEndpoint,
+		heartbeatEndpoint:    heartbeatEndpoint,
+		registerEndpoint:     registerEndpoint,
+		eTag:                 0,
+		deploymentsChanged:   make(chan interface{}, 5),
+		addSubscriber:        make(chan chan deploymentsResult),
+		removeSubscriber:     make(chan chan deploymentsResult),
+		apiInitialized:       false,
 	}
 
 	// initialize bundle manager