point them to jwt docs for the flow