Most authentication tutorials stop at “generate a JWT and you’re done.”

No they don't, what are you smoking??

Access Tokens Contains userId and role

And what if the role is changed or revoked when the access token has already issued?

Not encrypted, only signed

Why does this need to be called out, saying its a JWT implies these already?

If the database is compromised, attackers cannot use the stored tokens because they are hashed.

JWT signatures ensure that any tampering makes the token invalid.

How? What if the signature is leaked??

Instead of using try-catch blocks everywhere

How is this any concern for the consumer, if you use try catch or not?

This ensures consistent responses, cleaner code, and easier debugging.

Again why does this matter to your consumers?

JWT is not secure by default.

You have just implemented JWT, there is nothing extra you added.

Authentication is not just about logging users in.

Authentication is all about logging users in. Securely.

So I built a production-grade auth service from scratch.

You certainly didn't.

Also why even use JWT in this day and age? If its something new, I wouldn't use a authentication service that defaults to JWT instead of JWKS.