Let's Understand How It Works
Before we start implementing authentication, let's first understand the basic flow.
When a user logs in, they send their credentials (such as email and password) to the server through a login API. The server validates those credentials and, if they are correct, generates a JWT access token and returns it to the client.
The JWT contains claims that provide information about the authenticated user, such as their user ID, name, email, or role.
Whenever the client wants to access a protected API, it sends the JWT in the Authorization header:
