title: JWT Private / Public Key Confusion
body: <p>I'm trying to understand the logic of using JSON web tokens with private/public keys (RS512) when signing a payload of data sent from a client (in this case, a React Native App) to my server.</p>
  
  <p>I thought the whole point of private/public keys was to keep the <strong>private</strong> key private (on my server) and hand the <strong>public</strong> key to the person who's successfully logged into the app.</p>
  
  <p>I thought, with each API request to my server, the authenticated user of the app would use the <strong>public</strong> key to create the JWT (on the client side) and the server would use the <strong>private</strong> key to verify the signature/payload from the API request. </p>
  
  <p>It seems I have it backwards because everywhere I read, you're supposed to sign a JWT with the <strong>private</strong> key -- but that goes against my understanding of who's in possession of the keys.</p>
  
  <p>Depending on how the keys are created, some private keys can have a passcode which is supposed to be secret!  So if the private key and the secret is out in the open (in client-side code) how secure can that be?</p>
  
  <p>And where does the encryption come in?  If the user of the app is sending sensitive data in the API, am I supposed to encrypt the payload and sign it with the JWT on the client side and then let the server verify the JWT signature and decrypt the data?</p>
  
  <p>This tutorial was helpful <a href="https://medium.com/@siddharthac6/json-web-token-jwt-the-right-way-of-implementing-with-node-js-65b8915d550e" rel="noreferrer">https://medium.com/@siddharthac6/json-web-token-jwt-the-right-way-of-implementing-with-node-js-65b8915d550e</a> but it seems backwards.</p>
  
  <p>Any explanation would definitely help because all of the on-line tutorials aren't making sense.</p>
  
  <p>Thank you.</p>