The quickest way to confirm the Vanguard profile scope mapping is live, without echoing the raw token: the browser never sees X-Authentik-Jwt, so printing it would hand the user a bearer token for the proxy provider. Decoding is display-only and never feeds an authorisation decision. Verified against eight inputs including a numeric claim, a missing claim, a non-token and malformed base64. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>