JWT

Structure

{
  "sub": "user-uuid",
  "roles": ["CUSTOMER"],
  "customer_id": "cust-uuid",
  "iat": 1700000000,
  "exp": 1700000900
}

Signing

RS256 with key pair stored in AWS Secrets Manager. Public key distributed to Gateway and services.