Use subgroup token instead of project access token

In this way, we don't need to maintain too many tokens.