I really didn't understand what the tutorial is doing with JWT. BTW, PostgREST supports JWT for authentication, so there's nothing to do here unless this application is a sort of JWT issuer (but I really didn't get that sense at all).