==============================================================================
docs/output/01-user-token.txt
A complete authorization_code + PKCE flow, driven by curl. No browser, no OIDC library.
scripts/user-token.sh, then scripts/claims.sh
==============================================================================

{
  "alg": "RS256",
  "kid": "<uuid>"
}
{
  "aud": "downstream-api",
  "exp": <epoch>,
  "iat": <epoch>,
  "iss": "http://127.0.0.1:9000",
  "jti": "<uuid>",
  "nbf": <epoch>,
  "scope": [
    "orders.write",
    "orders.read"
  ],
  "sub": "alice"
}

# sub is the human. scope is what the human consented to. aud names the service the
# token was minted for - chapter 4 is about whether anybody looks at it.