def jwt_get_secret_key(payload=None):
    """
    For enchanced security you may use secret key on user itself.
    This way you have an option to logout only this user if:
        - token is compromised
        - password is changed
        - etc.
    """
    User = get_user_model()  # noqa
    if api_settings.JWT_GET_USER_SECRET_KEY:
        user = User.objects.get(pk=payload.get('user_id'))
        key = str(api_settings.JWT_GET_USER_SECRET_KEY(user))
        return key

    return api_settings.JWT_SECRET_KEY