Verify the caller's gateway-HMAC signature and mint a short-lived, read-only token. The token is accepted only on search, fares, destinations, and locations routes across verticals; every mutating guest route (fares/build, bookings/calculate-costs, protection-plans) rejects it. Requests made with the token execute under Mercury's existing shared service-account session — no traveler is ever provisioned, and no per-consumer account context is used.