We've been working on something very similar at work. I don't know if this solution scales very well, as others have mentioned here. One thing that seems unusual to me is the decision to use a POST request instead of GET for the /access endpoint.