A token that third parties can use to verify someone owns a specific system. They run pk;verify and get a token, give that to the third party, and the third party then sends it to https://api.pluralkit.me/systems/verify/:token and the server returns the public system object or 401 depending on whether it’s a valid token.

Should expire after an amount of time (10 minutes?) or when used

Suggestor’s use case would be better served by Scoped Tokens, however that’s a much bigger and more complicated feature