I want to create an express API (let's name it MASTER) that can authorize users of another API (let's name it SLAVE). I have a JWT secret in MASTER API which I create JWT tokens with, and send them to SLAVE API's users. I want the SLAVE API to be able to validate MASTER API's token, without knowing the JWT secret.
I think it can be accomplished with private key public key and packages like jwks-rsa but I don't know the exact logic behind it. How to generate the public key / private key and how does the exact flow work? Thanks in advance