How should JWT authentication be designed for production?

For production, use trusted signing keys, validate issuer and audience, enforce expiration, rotate keys, keep tokens short-lived where practical, and never treat unsigned or merely decoded JWT contents as authenticated identity. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.