You mean the public key? The private key is what's used to sign tokens, the public key is used to verify the signature and can be freely shared. Or maybe you mean they used a symmetric key and shared that?

Private key to SIGN the content.

what am I missing?

a JWT signature is the header and payload encrypted and attached. You would do that encryption via a private key, said public key would be used to verify it was encrypted by the private key.

What does "to SIGN" mean in this context?

I'm pretty sure he meant they were putting the private key in the jwt.

People do some dumb stuff. And the dunning kruger effect is all too real.

He said it was used to verify the token, which is only true if you use a symmetric key not a private key.

Right, from what they're saying, they're pulling the key out of the claims to verify the token.

No it doesn't make sense.

Because they got the code our of a reddit comment?