This version of the endpoint that just gets the signed token can be a GET request. It's just the authentication request that should be POST.