Cisco SD WAN Architecture Diagram of JWT Token Flow

Tech architecture infographic titled "JWT Token Flow" using archetype HOW-IT-WORKS adapted from a token lifecycle flow for a mid-level developer audience. Create a hand-drawn whiteboard style technical diagram with cool blue and cyan palette, editorial developer-blog illustration, isometric or flat tech-diagram style, vector-clean infographic layout. Show labeled boxes connected by directional arrows: Browser — "User client that sends login request, stores token, and calls protected endpoints" with browser icon; API Gateway / REST API — "Receives credentials, validates JWT, and returns JSON responses" with server icon; Auth Service — "Authenticates user and issues signed JWT access token" with shield-key icon; Cache — "Stores session metadata, token denylist, or refresh token lookup" with cache icon; Queue — "Processes async audit and login events" with queue icon; Database — "Stores user records, password hash, roles, and refresh token data" with database cylinder icon; Generic Cloud Edge — "Public network entry over HTTPS" with generic cloud icon. Use arrows with short English labels showing technically accurate flow: Browser to Generic Cloud Edge labeled "HTTPS POST /login + credentials"; Generic Cloud Edge to API Gateway / REST API labeled "REST JSON request"; API Gateway / REST API to Auth Service labeled "Validate credentials"; Auth Service to Database labeled "SELECT user, roles, password hash"; Database to Auth Service labeled "User record"; Auth Service to Cache labeled "Store refresh token metadata"; Auth Service to Queue labeled "Publish login audit event"; Auth Service to API Gateway / REST API labeled "JWT access token + refresh token"; API Gateway / REST API to Browser labeled "200 OK JSON response"; Browser to API Gateway / REST API labeled "HTTPS GET /resource + Authorization: Bearer JWT"; API Gateway / REST API to Cache labeled "Check denylist / session state"; API Gateway / REST API to Database labeled "SELECT protected data"; Database to API Gateway / REST API labeled "Result rows"; API Gateway / REST API to Browser labeled "200 OK JSON response"; optional expired-token branch Browser to API Gateway / REST API labeled "POST /refresh + refresh token" and API Gateway / REST API to Browser labeled "200 OK new JWT". Make the composition read left-to-right and top-to-bottom as a staged lifecycle, with subtle numbered circles near key arrows and components. Include a numbered legend 1-7 in English: 1. "User submits credentials from the Browser over HTTPS." 2. "API forwards authentication to the Auth Service." 3. "Auth Service verifies password hash and loads roles from the Database." 4. "Auth Service issues a signed JWT access token and stores refresh metadata in Cache." 5. "API returns 200 OK with JSON payload containing token data." 6. "Browser calls protected REST endpoints with Authorization: Bearer JWT." 7. "API validates the JWT, checks state, fetches data, and returns the response or refresh path." Add a small note box in English: "Conceptual developer diagram, not an audited security reference architecture." Keep all component names canonical English-tech form. Avoid ETL warehouse visuals; prioritize authentication request lifecycle accuracy while preserving a clean infographic structure. All text MUST be written in English (array). Every heading, label, caption, legend and metric name in the image must be in English — not English. Spell each English word correctly using English characters and diacritics. Numbers stay as digits, no real cloud-vendor logos (AWS / GCP / Azure) — use generic cloud icons, no watermarks No real cloud-vendor logos (AWS, GCP, Azure) beyond generic cloud icons. Common protocol names (HTTPS, TCP, JWT, OAuth, REST, GraphQL) stay in canonical English form. No security-claim overstatements (do not present diagrams as audited reference architectures).