I have a Python application in the works with FastApi, utilizing JWT and OAuth2 password flow for user authentication. Following their documentation, upon user login, a token is issued using the HS256 algorithm along with a specific user secret key. This token is then stored in the browser's local storage. Subsequently, for requests dependent on the current logged-in user, the token is sent to the backend, decoded using the same secret key, and the required information is extracted. My application interfaces with a PostgreSQL database, raising the question of where to securely store these secret keys used for generating tokens across different user types.
Appreciate any insight!