A token with only the profile scope can call verify_credentials, as in Mastodon 4.3. The answer is the public account, so apps can use it to log users in without seeing their email or settings.
