A method for regulating access to a protected resource is disclosed. The method includes: receiving, via the communication interface from a client application executing on a first device, a first signal including a request to obtain an access token for accessing a protected resource, the request including: a client identifier uniquely identifying the client application; an authorization code for authorizing the client application's access of the protected resource; and a public key associated with the end user; and in response to validating the request: encrypting the authorization code using the public key to generate a first code; and transmitting, via the communication interface to the client application on the first device, a second signal including both an access token for accessing the protected resource and the first code.