diff --git a/app/models/user.rb b/app/models/user.rb
index a531766..dde6184 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -332,7 +332,7 @@ class User < ApplicationRecord
       redirect_uri:,
       client_id: ENV["HCA_CLIENT_ID"],
       response_type: "code",
-      scope: "email"
+      scope: "email slack_id verification_status"
     }
 
     URI.parse("#{HCAService.host}/oauth/authorize?#{params.to_query}")
@@ -382,23 +382,33 @@ class User < ApplicationRecord
     return nil if access_token.nil?
 
     # get user info
-    identity = ::HCAService.me(access_token)
+    hca_data = ::HCAService.me(access_token)
+    identity = hca_data["identity"]
     # find by HCA ID
     @user = User.find_by_hca_id(identity["id"]) unless identity["id"].blank?
     # find by slack_id
     @user ||= User.find_by_slack_uid(identity["slack_id"]) unless identity["slack_id"].blank?
     # find by email
     @user ||= begin
-                EmailAddress.find_by(email: identity["email"])&.user unless identity["email"].blank?
+                EmailAddress.find_by(email: identity["primary_email"])&.user unless identity["primary_email"].blank?
               end
 
-    # update scopes if user exists
-    @user.update(hca_scopes: identity["scopes"], hca_id: identity["id"]) if @user
+    # update scopes etc if user exists
+    @user.update(
+      hca_scopes: hca_data["scopes"],
+      hca_id: identity["id"],
+      hca_access_token: access_token
+    ) if !!@user
 
     # if no user, create one
     @user ||= begin
-                u = User.create!(hca_id: identity["id"], slack_uid: identity["slack_id"], hca_scopes: identity["scopes"])
-                EmailAddress.create!(email: identity["email"], user: u) unless identity["email"].blank?
+                u = User.create!(
+                  hca_id: identity["id"],
+                  slack_uid: identity["slack_id"],
+                  hca_scopes: hca_data["scopes"],
+                  hca_access_token: access_token,
+                )
+                EmailAddress.create!(email: identity["primary_email"], user: u) unless identity["primary_email"].blank?
                 u
               end
   end