The dashboards' AppSync Events subscribe token: an HS256 JWS that cfx-events-authorizer verifies (docs/proposals/ABLY_REPLACEMENT.md §6). The dashboards only sign it, so rotation lives on the verifying side.
cfx-events-authorizer
Seconds since the epoch, at most EVENTS_TOKEN_MAX_TTL_SECONDS after iat.
EVENTS_TOKEN_MAX_TTL_SECONDS
iat
Seconds since the epoch.
The raw customer id, bank id or operator user id.
The dashboards' AppSync Events subscribe token: an HS256 JWS that
cfx-events-authorizerverifies (docs/proposals/ABLY_REPLACEMENT.md §6). The dashboards only sign it, so rotation lives on the verifying side.