The whole hunk
from line 187, old and new numbered
/
lines
from line 187
187187
188188 **The gateway MUST validate `iss` AND `aud`, not just the signature.** Signature + issuer alone accepts *any* token from the same tenant, including tokens issued to unrelated apps. In `id_token` mode the audience is the `clientId`:
189189
190 ```yaml theme={null} theme={null}
190 ```yaml theme={null}
191191 # LiteLLM example — `audience` is REQUIRED, not optional
192192 general_settings:
193193 litellm_jwtauth: