Create a personal access token (PAT) with OpenIddict

In OpenIddict, is it possible to have a second token endpoint that requires authorization and returns a long-lived token?

I'm converting a .Net Framework application to Core. As part of that I'm trying to swap the OAuth portions to OpenIddict. I've got standard authentication working using token endpoint just fine. What I've been unable to do, or find an example of, is a second authenticated endpoint that generates a different token.

The purpose of the second endpoint is to provide a token similar to the PAT you get from GitHub or Azure DevOps

I was able to use this code to create a token on a second endpoint, but was not valid for authentication as I could not register it with OpenIddidct

var options = _oidcOptions.CurrentValue;
var descriptor = new SecurityTokenDescriptor
{
    Claims = new Dictionary<string, object>
    {
        { "sub", "your user id" },
        { "scope", "your scopes" },
    },
    EncryptingCredentials = options.DisableAccessTokenEncryption
        ? null
        : options.EncryptionCredentials.First(),
    Expires = null, // recommended to set this
    IssuedAt = DateTime.UtcNow,
    Issuer = "https://contoso.com/", // the URL your auth server is hosted on, with trailing slash
    SigningCredentials = options.SigningCredentials.First(),
    TokenType = OpenIddictConstants.JsonWebTokenTypes.AccessToken,
};

var accessToken = options.JsonWebTokenHandler.CreateToken(descriptor);