A Supabase auth token has aud set to the literal string authenticated, and a role claim (typically anon or authenticated) that Postgres Row Level Security policies read directly to decide what the request is allowed to touch.
Signing is a real point of difference from the other providers on this page: Supabase has historically signed tokens with HS256 — a shared secret, not a public/private keypair — where Auth0/Firebase/Okta/Clerk above all typically use RS256 asymmetric signing. Supabase does now support asymmetric algorithms (RS256/ES256) as an option; check your project's JWT settings to see which your project actually uses before assuming.