Issuing Access Tokens for Introspection

#33 and related PR #94 cover the issue of changing the token verification request to align with the Token Introspection spec. The decision to adopt this, and a specific definition that requires the issuance of credentials to access the token introspection endpoint requires the discussion of an out of band method to issue those credentials, which would take the form of a separate access token.

To quote @aaronpk https://github.com/indieweb/indieauth/pull/94#discussion_r720435825, "_Basically it means that when I build a service like Aperture, which is going to be validating access tokens from the user's own AS that they bring, I need to add a step in the signup flow that asks them to create an access token specifically for Aperture that can be used to validate access tokens. I like that because it means the user has some understanding that they are turning Aperture into part of their own website rather than it being something more decentralized, since in reality it is a service I am running for people. Later we can talk about how to automate the issuing of tokens like these, which would be another OAuth flow and probably some new scopes to add to a spec._"

This is the place to discuss this matter in future.

Start by reading issue #33 and PR #94, especially the linked discussion about token introspection credentials. The issue is currently a place for future discussion, so completion would require a decided credential-issuance approach and a clearly documented implementation scope.

Written by the indexing model from the issue text.