Perhaps introduce Codec<I, O> extends Encoder<I, O>, Decoder<O, I> for a symmetric codec that does both - for Base64 and Base64URL, it's just simpler to have a component that does both and can be referenced in multiple places. Plus it's annoying to try to remember which static utility class (Encoders or Decoders) you should reference during coding or tests, when just calling Codecs would always work.

Configuration methods (encoder(Encoder), decoder(Decoder), etc) should not be changed - APIs should accept only the minimum of what they require to function.

This would allow also deleting of all private/protected and package-protected classes/methods in the api module's io.jsonwebtoken.io package (7+ classes or so)