Traced how my API Gateway handles JWT today. The gateway receives the request, pulls the token from the Authorization header, verifies the signature using the secret key, and only then forwards the request to the right microservice. If the token is invalid it never reaches the service at all. I wrote this code months ago but I was thinking of it as "authentication middleware" — today I understood it's actually a bouncer at the door, not a check inside the room. The decision to verify at the gateway level instead of each service was the right one — because if each service verified tokens independently, a bug in one service's auth logic could expose all the others. One gate is easier to secure than six. I just didn't know why until now over each service checking its own token because one gate is easier to secure than six