What are your biggest JWT dev headaches?

When working with JWTs, what trips you up the most? What are the most annoying things you have to deal with? Validation? Debugging? Would love to hear the community's thoughts on this...