The customer's tier is a public profile on their token

Your partner integrations keep asking the same question: which tier is this customer on, and is it really them? You answer with an entitlements API, a partner key, and a rate limit on it.

The token you issued the customer already carries a public profile. At creation, or later with a PUT, you attach public_storage: {"display_name": "Acme Corp", "tier": "gold"} and an ED25519 public_key. Any Hoody caller can then GET /api/v1/auth/tokens/public-profiles/{public_key} and read the profile: never the token, only the storage you chose to publish, up to 64KB.

The customer hands a partner their public key. The partner resolves it and gets the tier from the platform, not from a claim in a request body. Upgrade the customer, PUT the profile, and every partner sees gold on the next lookup.