Migrated Catalog API authentication from NextAuth's JWE shared-secret decryption (a kind of reverse engineered hack) to Better Auth's JWKS public-key verification. The auth change itself was straightforward, but the real complexity was coordinating the configuration across multiple services and multiple environments, each with different network topologies where the same service has different URLs depending on who's talking to it. :( https://better-auth.com/