Might I suggest Paseto (https://paseto.io/ https://paseto.io/) instead of writing it yourself - it solves a lot of the headaches of JWT. Signing and encryption

Might I suggest Paseto (https://paseto.io/ https://paseto.io/) instead of writing it yourself - it solves a lot of the headaches of JWT. Signing and encryption are two different things that require two different sets of keys, so you can't mess it up. (Full disclosure, I've written one implementation: https://github.com/auth70/paseto-ts https://github.com/auth70/paseto-ts)