#12 - Implementing JavaScript Web Tokens

For part 12 of this assignment (In the Level 3: Hard section), which endpoints require JWT verification? I'm asking because if the /api/user endpoint were to require JWT verification, how would a user of this application go about creating an account if they need a web token from the very beginning? Please let me know ASAP. I'm almost done with this assessment and can't wait to submit my Bits of Good application. Thanks!