Questions for Tom: 1.) How are you handling auth? Are you using a home grown solution or using OpenID Connect + OAuth 2.0? 2.) Is the JWT behind the firewall

Questions for Tom: 1.) How are you handling auth? Are you using a home grown solution or using OpenID Connect + OAuth 2.0? 2.) Is the JWT behind the firewall using a pre-shared key? 3.) What does the public token look like and how does the API Gateway perform auth? Does the token passed into the API Gateway contain only a user id? And does the API Gateway have to perform a database query to populate the full user object? side note: Thanks for writing the article.