hiimcharlies

Thank you! I'll ask some more questions tommorow after I sleep on it if you don't mind.

> API Gateway intercepts the request from the web app, extracts out the access_token, talks to the Token Exchange endpoint (or the STS), which will validate the access_token and then issues a JWT (signed by it) to the API Gateway.

What is "it" in this quote? Will JWT be signed by API Gateway?

Otherwise.. a great article! Made my understanding of security princinples in architecture like that MUCH clearer