title: Hide JWT token in Javascript
body: <p>I've implemented a JWT authentication for my rest api.</p>
  <p>I'm struggling to understand how to hide the token in JavaScript.</p>
  <p>For example, all the clients (web browser and mobile phone app) will call my api with an header:</p>
  <pre><code>Authorization': 'Bearer eyJ0eXAiOXXXXXXX
  </code></pre>
  <p>In PHP it makes sense, but in JavaScript &quot;everyone&quot; can see the token. So what's the point of having one?</p>
  <p>Even if the token expires after X minutes, all you need to do is get the new token every X minutes, and you have access to the same API.</p>
  <p>Did I miss something?</p>