Hi @oliverf82757722 - for JWT token handling, we recommend to use @adobe/aio-lib-ims which is supported by Project Firefly. As a side note, regardless of the JWT library being used, it's important that your action in that case should not be exposed as a web action, which makes it accessible to the public.
W.r.t. meta scopes, you should put them in an array, e.g. `metaScopes : ['ent_user_sdk']`.