Implement "Third Party" OAuth2 Token Endpoint for D2IR (INN-Reach)

Current situation or problem:
The Direct to INN-Reach (D2IR) APIs require a Bearer Auth token for authentication, and the central server must request such a token from FOLIO prior to calling any D2IR API endpoints provided by FOLIO. However D2IR integration is implemented in FOLIO, the module(s) will need to provide facility to issue Bearer Auth tokens to the central server with these requirements:

An API Key and Secret, which should be concatenated together with a ":" and then base64-encoded.

Content-type header: application/x-www-form-urlencoded

grant_type: client_credentials&scope=innreach_tp

Here is an example from the API Documentation (v2.3, pg. 8):

curl -X POST http://rd-mock.polarislibrary.com/innreach/v2/oauth2/ token -H 'Accept: application/json'
   -H 'Authorization: Basic
   ZmQ1OTdlXmItMjNkLS00ZWZiLAE0ZjUtN2Y2NJFhNDc2Njk2OjVhMjcxMjdhLUk0YmUtNG
   JhYi05MDMzLWI1MmFjMzkxOTQ3Yg=='
   -H 'Content-Type: application/x-www-form-urlencoded'
   -d 'grant_type=client_credentials&scope=innreach_tp'

Sample response:

{
"access_token": "06b42df732f628ae2c3764d86073cd76", 
"token_type": "Bearer",
"expires_in": 599
}

Tokens are valid for 600 seconds. Expired tokens result in "401 Unauthorized" response.

Note: Endpoints should be versioned (/innreach/v1, /innreach/v2, etc.)

In scope
API Endpoint to provide OAuth2 Bearer Tokens to a client based on supplied Base64-encoded key/secret pair.

Out of scope
API client for requesting OAuth2 Bearer Tokens from Central Server based on supplied Base64-encoded ket/secret pair

Questions

• How are key/secret pairs generated, stored, invalidated?
• How do we verify provided tokens?
• How does authorization interact with FOLIO's built-in permissions?