heh, funny thing is that jwt.io is able to properly decode it and it doesn't complain. jsonwebtoken and jose all return null, that's what got me into this rabbit hole 😄