Nobody is answering my question in github issue... ... thought I ask here again?

[mathiasconradt]

I think this is a general question about the concept of how OAuth2 and JWT / access tokens are meant to be used against an API.

This should be a relevant doc with instructions to start with:

https://auth0.com/docs/microsites/protect-api/protect-api