Конечно. Всё выше сказанное правда. Давайте обсудим этот вопрос. Здесь или в PM.
Since the id token is not signed by the api, the api would not have had probability become the owner whether the application modified the token (for example, whether it added additional areas), if if it accepted the id
https://www.softhouse.co.th/blog/2020/07/25/hello-world/ [pr].