NetworkAccessToken

Derives narrowly scoped bearer tokens from the shared RSPM network key.

The raw Floodgate-derived network key is never sent over HTTP. Each protected capability gets a distinct domain string, so possession of a token for one route does not authorize another route or reveal the network key.