Ironically, authorization downstream of an API gateway is an application that JWTs are a good candidate for.