Takes no credential. The signed token in the URL is the credential,
which is why it is short-lived and single-use.

Returns the amount, the fields that corridor needs, and saved
destinations masked to name, label, and last four digits. It deliberately
returns no organization id, no endUserId, and never full bank details.
A public route that echoes back what was typed turns a forwarded link
into a disclosure of someone's account number.

Expired, spent, forged and tampered tokens are all a flat 404. A
stranger probing links learns nothing from the difference.