Inspect JWT claims before you trust them
Authorization bugs often trace to misunderstood claims: a token decodes fine yet lacks the role your API expects. Reading header.alg and payload scopes locally helps separate format problems from policy problems.
Header algorithm hints
The alg field declares signing method—HS256, RS256, and ES256 are common. If alg is none or unexpected, halt and review issuer documentation before accepting the token in production middleware.
Expiry and clock skew
Compare exp to current epoch time, allowing a small skew window your gateway already implements. Short-lived access tokens paired with long refresh tokens are normal; confusing the two causes false "already expired" reports.