The authenticator service contract.
Decode a token without verifying it (never trust the result for authorization).
Sign a token from claims.
Verify a token and return its claims (throws on invalid/expired).
The authenticator service contract.