HTTPS is used for external communication, while plain text HTTP is used inside the system landscape

The local OAuth 2.0 authorization server will be accessed externally through the edge server

Both the edge server and the product-composite microservice will validate access tokens as signed JWTs

The edge server and the product-composite microservice will get the authorization server's public keys from its jwk-set endpoint and use them to validate the signature of the JWT-based access tokens