Real World Example

• Swiggy / Zomato: the app talks to an edge gateway; internally, order, restaurant, delivery and payment services call each other with service credentials.
• Netflix (Zuul, later its own gateways) and Uber pass user identity from the edge to hundreds of internal services.
• Banks require mTLS plus OAuth2 service tokens between internal APIs.

1. React  POST /api/orders (session cookie + X-XSRF-TOKEN)  -> gateway
 2. gateway: session -> user access token (refresh if needed), TokenRelay
 3. order-service  <- Bearer <asha's JWT>      checks SCOPE_orders.write, sub = asha
 4. order-service  -> user-service   Bearer <asha's JWT>          GET /api/users/me/addresses/12
 5. order-service  -> inventory      Bearer <order-service JWT>   POST /api/stock/reservations
 6. order-service  -> payment        Bearer <order-service JWT>   POST /api/payments
 7. order-service  -> Kafka "order-placed" { orderId, customerId: asha }  (no token in events)
 8. 201 Created back through the gateway

@PostMapping
@PreAuthorize("hasAuthority('SCOPE_orders.write')")
public ResponseEntity<OrderDto> placeOrder(@AuthenticationPrincipal Jwt jwt,
                                           @Valid @RequestBody PlaceOrderRequest request) {
    String customerId = jwt.getSubject();                          // never take this from the request body
    Address address = userClient.address(request.addressId());     // user token: only own addresses
    inventoryClient.reserve(request.items());                      // service token
    Order order = orderService.create(customerId, address, request.items());
    paymentGateway.charge(order.getId(), order.getTotal());        // service token
    events.publish(new OrderPlaced(order.getId(), customerId));
    return ResponseEntity.created(URI.create("/api/orders/" + order.getId())).body(OrderDto.from(order));
}

curl -i -X POST https://shopease.in/api/orders \
  -H "Cookie: SESSION=YjM0ZDI1..." -H "X-XSRF-TOKEN: 6c1f0e2a-..." \
  -H "Content-Type: application/json" \
  -d '{"addressId":12,"items":[{"productId":7,"quantity":2}]}'

HTTP/1.1 201 Created
Location: /api/orders/1058
Content-Type: application/json

{"id":1058,"status":"PAID","total":1798.00,"customerId":"9b1d2c3e-41f5-4a6b-8c7d-0e1f2a3b4c5d"}