The caller arrives already verified
Invoke with a user's access token and Volcano validates it, then puts the result on the event as __volcano_auth. Your handler reads a user id, not a JWT.
- user_id, email, role and project_id on the event
- Their access token too, so one function can call another as them
- Anon key reaches public functions only
{ user_id: '8f1c4b0e-…', email: 'ada@acme.com', role: 'authenticated', project_id: '…', access_token: 'eyJhbGciOi…'}signature already checked before your code ran

