You got that right. In addition to what you described, the JWT spec also supports an RS family of algorithms (asymmetric). It means that you can sign with a pr

You got that right. In addition to what you described, the JWT spec also supports an RS family of algorithms (asymmetric). It means that you can sign with a private key and verify with a public key. For instance Google, sign every JWT with the same private secret and publish their key for verification [1]. If you use this, your server-side application not only needs to verify that the JWT signature is correct but also that the audience is your application. I wrote an example middleware for connect to verify Google's JWTs [2]. [1]: https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken https://developers.google.com/accounts/docs/OAuth2Login#vali... [2]: https://www.npmjs.org/package/connect-google-jwt https://www.npmjs.org/package/connect-google-jwt