Add jwt verification on the api

api/.env.example

@@ -1,6 +1,11 @@
 # vi: ft=sh
 # shellcheck disable=SC2034
 
+# either an hard-coded secret to decode jwts or empty to use keibi's public secret.
+# this should only be used in tests
+JWT_SECRET=
+# keibi's server to retrive the public jwt secret
+AUHT_SERVER=http://auth:4568
 
 POSTGRES_USER=kyoo
 POSTGRES_PASSWORD=password