I’ll answer my own post, that or delete it. There’s enough history to Twitch Apps & Extensions that the documentations is a big fragmented but I’ve since made lots of finds in the documentation. The result is that my question above is kind of unanswerable.
There are Apps & there are Extensions. Apps came first. They were built on the v5 API. The docs relevant to auth & JWTs is in there. There are 3 different types and the best way to get your head around them is to do the examples in curl.
I’m still not clear on the crossover of Apps & Extensions where it concerns authentication. The demos speak of client IDs and secrets, but there are two sets, one for Apps and one for Extensions. I don’t quite understand which set to use but I did use my App config for the curl examples linked above.
I’m focussed on developing the backend for a Video Overlay type extension, if there’s any pointers for that.