Provision 3-tier API tokens bound to specific organization permission tables, verify entitlements, and revoke credentials.