How can this work, when it generates a new key for every operation?

[Stokestack]

Thanks for the tutorial.

I'm getting verification failures, however. The problem is that you're never using the same key. First you generate a JWT with:

    //authenticate a user
    const payload = {
        id: user._id,
        name: username
    };
    const jwt =  await create({ alg: "HS512", typ: "JWT" }, { payload }, key);

The key value above is created on the fly by this, in apiKey.ts:

export const key = await crypto.subtle.generateKey(
    { name: "HMAC", hash: "SHA-512" },
    true,
    ["sign", "verify"],
  );

But later, when you try to verify the JWT from an incoming query, you create a whole new key and use it:

    //authenticate a user
    const payload = {
        id: user._id,
        name: username
    };
    const jwt =  await create({ alg: "HS512", typ: "JWT" }, { payload }, key); <-- key is generated again in apiKey.ts.

So you're encoding with one key and trying to decode with another. This always fails.