Add POST /tokens — Token creation

Yes should be `hmacId`