Credentials

1. User can get an access token by using the POST /token endpoint w/ a request body like

   {

     "credentials": {

       "username": "my-api-username",

       "password": "my-api-password"

     }

   }

2. They should use the idToken included in the response. It is valid for 1 hour. If they need to refresh, they can use the refresh token to request a new token at the POST /token endpoint like:

   { "refreshToken": "<refresh token>"}

3. Once they have the token, they can use it in an API request in the Authorization header, for example Authorization: Bearer <insert id token>