I was not happy with the name `token` either since it sounded too generic. However, Twitter has named their method `token` after all, and the returned JSON data has a field that specifies the `token_type`.

As you say in your first sentence, it might be the case that this end point will not remain specific to application-only bearer tokens, so it seems wrong to name it `app_token`. Do you have any other suggestions?