Protecting Node.js APIs: Audiences, Scopes, and Bearer Tokens

Most APIs leak in the same handful of ways: missing audience checks, scope rules scattered across handlers, JWT validation that drifts out of date, tokens issued for one service quietly accepted by another. Each one is small on its own, and each one ends up in a postmortem. This post walks through the patterns that prevent those failures — token validation done right, per-API audience isolation, route-level scope enforcement, and server-side token forwarding from a front end. The code samples co