Yea that’s fine. Remember that stuff u put in the jwtPayload cannot be sensitive info. And that info cannot change over the course of the session.