Using the flow authentication API with JWTs and one-shot authentication

Use this variant if the REST client (e.g. mobile app) needs a bearer token that can also be used with 3rd party systems that are not connected to IAM.