At present an AUTH_API_KEY has the format:

88SwQDWYGmiDACVRaBGqQghzLd5jfX7YynefCJ8M/88SwQH8CEDWzWSq7PyWe7ADpjYCpmczr5zyTK4d/authdemo.fly.dev

Note: this is not a valid key. but the format is correct.

The reason I wet with this and still like it is because it's human-readable
and immediately obvious which environment (auth instance) it's for; in this case: authdemo.fly.dev
So if I see this key in my .env file or environment variable, I know exactly what it's for. 👌
I think this has a pretty major advantage in terms of Developer Experience ... 💭

But equally it has a disadvantage: no embedded info like expiry.
We outlined the benefits of JWTs in our mega-popular doc: https://github.com/dwyl/learn-json-web-tokens
And we are using them in auth for session tokens:

So my question is: should the next version of auth (and auth_plug) use a JWT as the AUTH_API_KEY?
Will having a JWT for the AUTH_API_KEY and a different JWT for session token be confusing to devs? 🤷‍♂️
Are we missing something?

Please let me know your thoughts ... 💭 🙏