Category
The real leak vectors ranked, the non-negotiables at any size, a three-rung maturity ladder that mostly stops at rung two, and rotation as a rehearsed muscle with two-key overlap.
The honest three algorithms, layered key design including the abuse limits everyone forgets (per victim, not per attacker), the 429 contract, and operational rules — fail open, shadow mode, degrade before deny.
The founding delegation story, the cast renamed into English, the one flow that survived (auth code + PKCE) with every step's attack labeled, ID vs access tokens untangled, and the do-you-even-need-this triage.
Why revocation is where stateless goes to die, the XSS blast-radius problem, the specific habitats where JWTs genuinely shine, and the sessions-at-the-edge / tokens-between-machines architecture.
