this is in a serverless environment. without a server i can't use a JWT otherwise it woudl be visible on the front end