Imagine a perfectly valid token arriving at the wrong service. Its signature checks out. It has not expired. Yet accepting it would still be a mistake: it was issued for a different API. This is the part of service-to-service auth that is easy to miss when the conversation starts and ends with “we use JWTs.”

When one internal service calls another, “they are both inside our network” is a weak authorization rule. The useful question is specific: may orders-service create an invoice in billing-api ?

I use four names to answer it:

Name In this example What it means

Client orders-service The service making the call

Audience billing-api The API meant to receive the token

Scope billing.invoice.create The action the client may request

Issuer Orionis The service that authenticates the client and signs the token

Those four values carry different responsibilities.…