Thanks! This is just the MVP so far. Hopefully it'll get more fun as I find time to work on it.

Also, that request id helped a lot. It looks like I somehow have a newer version of joserfc in production compared to dev, and that version is a little more strict in what you can set sub to in a JWT. I reproduced the error as soon as I upgraded. Now to fix this and figure out why prod dependencies are getting ahead of dev...