A retail company is building a new customer-facing mobile app that authenticates users and calls a set of RESTful backend APIs. The identity team wants a federation standard that is JSON/REST-friendly, natively issues tokens suitable for authorizing API calls, and works well with native mobile clients. Which standard should they adopt?