Start an OIDC authorization flow and return here with an ID token.
Token controls:
Start a direct API handshake and redirect to verification. Enroll is the default path.