auth.access-token
Issue an API's HS256 access token, read one from an Authorization header, and refuse revoked or superseded ones.
A group of 3:
issue_access_token, read_access_token, confirm_access_token