There are two primary architectural patterns for microservice token processing:

• Centralized Gateway Offloading: The API Gateway validates incoming JWT signatures, strips client tokens, and forwards sanitized headers (X-User-Id, X-User-Roles) to downstream microservices over a private network.
• Distributed Service Validation (Defense in Depth): The API Gateway passes the Bearer JWT downstream, and each microservice independently verifies token signatures using shared public keys fetched from a central JWKS service.