# D002 — veraeUserId is the join key, not the JWT

**Status:** accepted  
**Step:** 2

Public token remains the zappier API key. Chain JWT stays server-side (`tokenRef`). `zappier-identity` is the mailbox for bind/lookup so portal and middleware share one map.