Use built-in authenticate_or_request_with_http_token

Hat tip to @adrienpoly

app/models/identity.rb

@@ -14,8 +14,10 @@ class Identity < ApplicationRecord
   validates :email_address, format: { with: URI::MailTo::EMAIL_REGEXP }
   normalizes :email_address, with: ->(value) { value.strip.downcase.presence }
 
-  def self.find_by_access_token(token)
-    AccessToken.find_by(token: token)&.identity
+  def self.find_by_permissable_access_token(token, method:)
+    if (access_token = AccessToken.find_by(token: token)) && access_token.allows?(method)
+      access_token.identity
+    end
   end
 
   def send_magic_link(**attributes)