jwt has header payload and signature so signature created using header payload and secret key when user logs in server generates jwt token with secret key and sends to user .When user makes any request that token send back to server then server verifies token by its secret key .