This doesn’t seem to offer useful authentication to me like public / private key pair can with JWT. In order to authenticate I will need to know the secret key.