# JWT best practice and understanding **URL:** \ **Category:** JWT.io\ **Created:** [March 3, 2022, 12:38pm UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211 "2022-03-03T12:38:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![HuG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hug/32/32661_2.png) [@HuG](https://community.auth0.com/u/HuG)\ **Post date:** [March 3, 2022, 12:38pm UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211/1 "2022-03-03T12:38:06Z")
Dear all, I have an SPA (React) and a back-end API (Python), and I use a JWT `access_token` to authorize the client to use the API. My requirements in the back-end are: authorization to access the API, and identification of the user (simply accessing an id that can be used to query our own database). In order to be fast, I implemented the 2 steps with the same `access_token`, by implementing a rule to add the id in the `access_token`. This allows me to save some time by not further querying the `/user-info` endpoint to identify the user once authorized. Nonetheless, [in this article](https://auth0.com/docs/secure/tokens), I found the following advice: > Access tokens must **never** be used for authentication I think this is meant to provide advice for the application and not the API, but I wanted to be sure. So, here is my first question: - is putting an id (not really sensible information) in an `access_token` to identify the user in a back-end API ok? I have also another question regarding JWT. The `access_token`, if I understand well, is generated by Auth0 using a secret key (from the tenant - used to sign the token) and provided to the client on Login. Then, the validity of this `access_token` is verified in the back-end using the public key of the tenant. So, what I cannot explain is that [jwt.io](http://jwt.io) can verify the signature of a token without any information (given by the user) on the public keys. - How can [jwt.io](http://jwt.io) verify the signature of a token without any information on the public keys? Are they fetched automatically from the `iss` field of the token? I thank you very much for your time and answer ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [March 3, 2022, 2:00pm UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211/2 "2022-03-03T14:00:09Z")
Hi @HuG You can put a user ID in the access token. It describes WHO the authorization is for. The verification key is publically available: [Locate JSON Web Key Sets](https://auth0.com/docs/secure/tokens/json-web-tokens/locate-json-web-key-sets) John ---
**Author:** ![HuG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/hug/32/32661_2.png) [@HuG](https://community.auth0.com/u/HuG)\ **Post date:** [March 3, 2022, 3:26pm UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211/3 "2022-03-03T15:26:13Z")
Hello @john.gateley Thank you very much for your answer. It answers the doubts I had perfectly. Have a great day ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [March 4, 2022, 11:32am UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211/4 "2022-03-04T11:32:24Z")
No worries, we are here for you! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 19, 2022, 11:32am UTC](https://community.auth0.com/t/jwt-best-practice-and-understanding/79211/5 "2022-03-19T11:32:27Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.