title: Storing and Using JWT & Secret Key
body: <p>I have a login route for my app. I use <code>jwt tokens</code> to protect routes, but I have trouble to understand fully usage of <code>secret key</code>.</p>
  
  <p>I tought I need to use secret key to verify <code>jwt</code>. Whenever user logs in, I send <code>JWT Token</code> and <code>Secret key</code> to user. <code>JWT</code> is stored in local storage (phone or app storage)</p>
  
  <p>What should I about secret key? Should I both store to local and database?</p>
  
  <p><strong>Login Route</strong></p>
  
  <pre><code>api.post('/api/login', (req, res) =&gt; {
  
  var secretKey;
  
  require('crypto').randomBytes(48, function(err, buffer) {
      secretKey = buffer.toString('hex');
  
      //Create JWT and Secret Key
      jwt.sign({user}, secretKey, {expiresIn: '30s'}, (err, token) =&gt; {
          res.json({
              access_token : token,
              secret_key : secretKey
  
          });
      });
  
  
  });
  </code></pre>
  
  <p>});</p>
  
  <p><strong>Response After Login</strong></p>
  
  <pre><code>{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoxLCJ1c2VybmFtZSI6ImV4YW1wbGV1c2VyIiwiZW1haWwiOiJleGFtcGxlQGdtYWlsLmNvbSJ9LCJpYXQiOjE1NTExMTE1ODAsImV4cCI6MTU1MTExMTYxMH0.aSTVC-HcEdrH1KBNtuD_MoLZ8DWnSiM6bCqO4EgJ5zM",
  "secret_key": "2e6a98abb5b23339ad14601d3bedc1d23847498cb18daf8cfc98c2a2095ec8f47d80053f6d4e22b8f6419407ac3083dc"}
  </code></pre>