TIB to authenticate API users

Your “aud” claim could contain an array of client_ids. client_ids usually represent an application which you would potentially want to allocate all its users the same rate-limit, quota and ACL.
How would you suggest of doing this?