or a jwt from your user