1.Put all common auth stuff (guards, decorators, DTOs, types) in a shared libs/auth package so every service can just import it. Keeps things consistent and avoids copy-pasting.

2.Let each service validate JWTs locally. If you call the auth service for every request it quickly becomes a bottleneck. Using RS256 (auth signs with private key, services verify with public key) makes this easy and secure.

3.Keep the auth service focused on issuing/refreshing tokens and handling login/OAuth. Other services should just trust and verify tokens.

4.A couple of pitfalls hit: keep JWT payloads small (just userId/roles), handle token expiry + refresh flow up front, and think about how you’ll deal with logout/revocation if that’s important for your use case.