JWT Signature Invalid After Cursor Code Generation

1. JWT secret key was moved or regenerated during code organization
2. Algorithm changed (HS256 vs RS256) without updating verification logic
3. Secret key not trimmed, whitespace causing mismatch
4. Buffer encoding changed (utf8 vs base64)
5. Clock skew tolerance removed from token verification

Verify JWT_SECRET environment variable is identical across before/after. Check algorithm consistency in sign() and verify() calls. Ensure no string trimming/encoding changes. Add clock skew tolerance: { clockTimestamp: Math.floor(Date.now() / 1000), clockTolerance: 10 }