Issue an access token
RFC 6749 section 4.4 client_credentials. Authenticate with HTTP Basic
(client_id:client_secret) or with client_id and
client_secret in the form body.
Tokens are HS256 JWTs valid for one hour. They carry tenant_id,
mode, and the granted scope. Decode them at jwt.io to inspect.
POST
Body
application/x-www-form-urlencoded