Design the authentication architecture question: should each microservice validate tokens independently, or should a central API gateway handle it once?

Both patterns are valid tradeoffs: a central gateway validating tokens once and forwarding trusted internal headers/claims reduces duplicated logic and centralizes policy, but creates a single point that must scale and stay available, and requires the internal network to be trusted (since downstream services no longer independently verify). Each microservice independently validating its own JWT (via cached JWKS) removes that single point of trust and keeps services autonomous, at the cost of duplicating validation configuration across services — many production systems combine both: a gateway for coarse routing/rate-limiting, plus independent validation at each resource server for defense-in-depth.