jwt will need a unique id limit generate requests to 1 per 30 seconds or a minute to avoid generate and cancel spam