// Package usertoken mints and checks the short-lived RS256 user token an ExApp
// sends to Microservices.
//
// An ExApp calls [NewSignerFromEnv] and [Signer.Mint] after AppAPI has named
// the user. A Microservice calls [FromEnv] and [Auth.Middleware] or
// [Auth.UnaryServerInterceptor]. One process trusts either a static public
// key or an OIDC issuer, not both.
//
// The procedure, claims, and environment variables are in
// knowledge/platforms/nextcloud/exapps/authentication.md.
package usertoken