Groups is the caller's group list, always empty here: this console authorizes on the platform SuperAdmin fact alone, not on argocd RBAC groups. Absent for an anonymous caller.
Iss is the token issuer as the SPA expects to see it — the literal "argocd", so the UI never triggers an SSO redirect of its own. Absent for an anonymous caller.
Username is the validated principal's user ID — the opaque gateway id, which is what argocd's UI renders as the signed-in user here — or "admin" when the principal carries none. Absent when anonymous.