OAuth client C7 sends token T1 to mail-api. mail-api returns E7 copy received after it verifies issuer RiverAuth, audience mail-api, exp, and scope M7 read allowed. mail-api refuses a token for notes-api and a token from LakeAuth. An ordinary bearer token is reusable until exp.