API endpoints: /request_token, /verify_token, /request_identity_token (mTLS required), /refresh_identity_token (mTLS or identity token), /public_key (public), /ca_cert (public), /health (public)