title: Where do you get/find the JWT-Secret from firebase?
body: <p>I'm using firebase for my web/mobile apps and now have a back-end API I'm looking to use as well.
  The API requires a JWT token to authenticate the requests and to set it up, I need to specify the JWT Secret that is used to encrypt/decrypt the token.</p>
  
  <p>In firebase, I believe I retrieve the token using
  const token  = await firebase.auth().currentUser.getIdToken(); This is what I pass to the API.</p>
  
  <p>However, I have not figured out where I get the JWT-secret to configure? I have tried the API key that is shown in firebase console, I have also tried the server/client keys found at my console at <a href="https://console.developers.google.com" rel="noreferrer">https://console.developers.google.com</a>.</p>
  
  <p>however, no matter what, I'm getting a JWSInvalidSignature when trying to make requests to the API Call.</p>
  
  <p>Has anyone got this working? Where do I get the JWT-secret from firebase to configure on the API back-end? Thanks in advance.</p>
  
  <p>Here are the details:
  1. I am using a service called postGrest which auto-creates a web API on top of postgres DB. In order to authenticate the requests, you configure the service by  specifying a custom claim called "role", and you also need to specify the JWT-secret so it can decode the token.</p>
  
  <p>Here is my simple call to the API:</p>
  
  <pre><code>           const fetchdata = async () =&gt; {
             const token  = await firebase.auth().currentUser.getIdToken();
  
          let axiosConfig = {
             headers: {
                'Authorization': 'Bearer' + token
                     } 
               }
         const data = await axios.get(`http://localhost:8080/users`, 
         axiosConfig);
  }
  </code></pre>
  
  <p>Also note, I can simulate this in the bash command line using the following code: Note here that I'm getting the token from the getIdToken() above.</p>
  
  <pre><code>   export TOKEN="eyJhbGciOiJSUzI1NiIsImtpZCI6ImQ2YzM5Mzc4YWVmYzA2YzQyYTJlODI1OTA0ZWNlZDMwODg2YTk5MjIiLCJ0eXAiOiJKV1QifQ.eyJ1c2VyaWQiOiI1NSIsImlzcyI6Imh0dHBzOi8vc2VjdXJldG9rZW4uZ29vZ2xlLmNvbS9wb3N0Z3Jlc3QtYjRjOGMiLCJhdWQiOiJwb3N0Z3Jlc3QtYjRjOGMiLCJhdXRoX3RpbWUiOjE1NzExNTIyMjQsInVzZXJfaWQiOiJNMXZwQ3A2ZjlsaFdCblRleHh1TjlEdXIzUXAyIiwic3ViIjoiTTF2cENwNmY5bGhXQm5UZXh4dU45RHVyM1FwMiIsImlhdCI6MTU3MTE1OTQ0NSwiZXhwIjoxNTcxMTYzMDQ1LCJlbWFpbCI6InNwb25nZWJvYkBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsic3BvbmdlYm9iQGdtYWlsLmNvbSJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.nKuovs0Gx_ZKp17dI3kfz6GQofIMEOTA8RqTluwEs-5r-oTbKgpG33uS7fs7txVxvWIb_3fbN3idzfDHZevprMkagbHOd73CxTFBM7pr1bD2OKSK9ZPYfSt9OhvgJL51vBN3voLcNAb5iWVVl2XMqkcXeDoBi8IOKeZr27_DsRx48GSi7HieHWscF1lujSEr2C9tdAek3YyNnr3IcGI8cTSPHPaIbYl-8CaHQO2fUiGHEAaD7sqHxp3otJio56zOoNAy44P_nwORlMFZC0Rm8SaATpbmIkgbGYWHZHty70lmlYGVHTuM_hr2s7z2YhAjuacvBMgusZpyoVnoe3FQeA"
  
      curl http://localhost:8080/contacts -H "Authorization: Bearer $TOKEN"
  </code></pre>
  
  <p>What's returned is: {"message":"JWSError JWSInvalidSignature"} </p>
  
  <p>For the JWT-secret, I have tried several values, but none seem to work. This includes the "API Key" from firebase project, as well as trying "Generate key" which downloads a new .json file and inside there is a "private_key": that is along string.</p>