Sign in

Session state is carried in a signed token.

Tokens are RS256. The verification key is published at /public.pem and /.well-known/jwks.json for downstream services.