We should deploy a split JWT verification architecture: verify signatures locally with a cached JWKS for ordinary API calls, and perform live session introspection at the gateway for high‑risk transitions like account recovery, changing recovery methods, or unlinking identities.

Core balancing principle: verify JWTs locally with cached JWKS, while selectively triggering live session introspection at the API gateway for critical actions such as refresh‑token rotation, stolen‑session revocation, and sensitive account‑continuity decisions.

Adopt retain‑and‑retire guidelines: keep only keys and session results that still authorize the current request within the defined window, and delete outdated data; align retention with organizational needs and incident response plans.

Build a recovery state machine with auditable transitions (actor, reason, timestamp, correlation id) and emit structured events at trust boundaries to distinguish cryptographic failures from policy failures.

Define gateway policy to separate local verification for normal routes from live‑state checks for boundary‑sensitive operations, and benchmark both paths separately without hiding slower checks behind defaults.

Provide operational guidance with decoupled caches for issuer metadata and session policy, stable session handles, and explicit runbooks detailing who can revoke sessions and how recovery is recorded.

Offer a practical cost model with cautions: count rejections before verification, signed requests, and the sensitive fraction of signed requests; estimate live checks as S × q, and illustrate with example traffic to help planning, using real data in practice.

Discuss provider trade‑offs and consolidation: compare Auth0, Okta, Keycloak, Infrai by ownership of signing boundary, revocation responsiveness, and operational ownership; note consolidation brings policy and control trade‑offs.

Ensure failures are logged with precise, non‑sensitive reasons (e.g., jwt_expired, unknown_kid, inactive_session, live_check_unavailable) and validate per‑route policy for revocation and freshness.

Reference the OWASP Authentication Cheat Sheet for foundational guidance and best practices.

Emphasize practical boundaries: distribute public keys, cache JWKS, rotate explicitly, and bound refreshes for unfamiliar key identifiers with a negative cache to damp bursts; avoid repeated fetches for unknown keys.

Provide an implementation blueprint with a minimal TypeScript‑style interface and function (Claims, Session, SessionStore, authorizeRefresh) showing sequential verification and atomic refresh‑token rotation to prevent token reuse.