Issue opaque (random) access tokens and store their details in Valkey. Provide a userinfo endpoint protected by the access token. The userinfo endpoint can only show info that its scopes allow it to see.