curl -sf -X POST https://gateway.flocks.local/v1/mesh-token \
  -H 'Content-Type: application/json' \
  -d '{ "auth_token": "ops", "ttl_seconds": 600 }'

{
  "token":      "<base64>",
  "issued_at":  "2026-04-25T20:00:00Z",
  "expires_at": "2026-04-25T20:10:00Z"
}
The token is valid for the requested TTL. Tokens are single-use; the gateway records every claim and rejects replays.