So jwtPayload is sent to the frontend. Usually u store the userId and then user role in there. (UserId is already stored there for u). But u should not store anything sensitive