A signed JWT only proves integrity and (usually) who issued it. It does not prove the token was meant for your API.
Always check aud (audience) against the exact identifier your service expects before you trust any claims inside. A token minted for payments-api must fail loudly if someone presents it to admin-api.
Skip that check and a stolen or misdirected token becomes a free pass across services that share the same issuer.
Authentication says the token is real. Audience validation says it belongs here.
