How do I protect my backend apis using JWT Tokens?

I am tryign to make sure that only logged in users are able to make api calls. I tried the approach recommended in the docs but the tokens I keep getting from cookies in the browser are always “invalid” and cant be used. I am sure others have navigated this, any help would be appreciated . When i try to validate they return a false, which i guess is invalid.

Hi welcome! Can you not just hide access to the blocks / pages using visibility rules of “loggedin user”?