What are JWT's signed with?

It should:

If in local mode it’ll use the devRig secret.
If in live mode it’ll use your actual values