OIDC Access Token (mine is opaque, but docs say it should be JWT)