Function token_fingerprint 

pub fn token_fingerprint(nonce: &str) -> String

Hex SHA-256 of a token nonce / bearer string — the lookup-key shape used by CapToken::fingerprint. Standalone so callers holding only the bearer string (not a decoded token) can derive the same key.