JWT verification from a backend API