Issues a short-lived token pair scoped to one clinician, without their password, so the embedded UI can act on their behalf. Takes no request body. Return the response object to your front end unchanged and pass it to Blueprint.authenticate() — the field names are PascalCase and the widget reads them exactly as spelled. The access token lasts 600 seconds; the widget renews it itself from the refresh token, so the refresh token must reach the browser.