I think I can answer my own question. The client doesn't get a shared secret. JWT is a server sending a token to the client which the client then sends back li

I think I can answer my own question. The client doesn't get a shared secret. JWT is a server sending a token to the client which the client then sends back like a cookie. The client isn't allowed to modify the token or the data inside it. It's like a signed cookie.