Comment by sebazzz

So basically the server signs the token and afterwards the server can verify its own signature for every request with that token?