JWT creation response best practices
<p>I am implementing an API that is going to be authenticated using JWT. I am curious to what are best practices on the response to the creation of the JWT. Specifically, I would like to include a payload in the response body(some user related information that I do not want to put in the payload section of the token), and send back the token in the Authorization header. Other options I see are to include the token as well as the user information in the response body, or make the client user make 2 http calls, one for the token, the other for the user information. I would like to know what is the proper way of handling this scenario.</p>