Generally I would avoid storing much in JWT payload. Just the minimum stuff. Or stuff that’s required for all API calls (like userId or user role)