# Decisions

- HS256 over RS256 for v1 — single service, shared secret.
- Refresh tokens stored hashed, never in plaintext.