How can this work, when it generates a new key for every operation?

Thanks for the tutorial.

I'm getting verification failures, however. The problem is that you're never using the same key. First you generate a JWT with:

```
//authenticate a user
const payload = {
id: user._id,
name: username
};
const jwt = await create({ alg: "HS512", typ: "JWT" }, { payload }, key);
```

The `key` value above is created on the fly by this, in apiKey.ts:

```
export const key = await crypto.subtle.generateKey(
{ name: "HMAC", hash: "SHA-512" },
true,
["sign", "verify"],
);
```

But later, when you try to verify the JWT from an incoming query, you create a whole new key and use it:

```
//authenticate a user
const payload = {
id: user._id,
name: username
};
const jwt = await create({ alg: "HS512", typ: "JWT" }, { payload }, key); <-- key is generated again in apiKey.ts.
```

So you're encoding with one key and trying to decode with another. This always fails.

Start with apiKey.ts and the tutorial's authentication snippets, then run the JWT signing and incoming-request verification flow described in the issue. Trace when the key is created and confirm whether the same key is available to both operations; done means the generated JWT verifies successfully instead of failing with a verification error.

Written by the indexing model from the issue text.