or in the server:

function getUserId(context) {
  const Authorization = context.request.get('Authorization')
  if (Authorization) {
    const token = Authorization.replace('Bearer ', '')
    const { userId } = jwt.verify(token, APP_SECRET)
    return userId
  }

  throw new Error('Not authenticated')
}

yes, this is what i m doing right now... i dont understand... in index.js and prisma.yml, i specified the secret (from env vars), those 2 places should be the ones for the app and the dev playground respectively.