Currently we have a single Flask API that serves our mobile application. It uses short-lived JWT tokens with a refreshing mechanism for authentication and that all works fine.

We need to add a chat server, which is something that we'd like to create a separate API for (probably in Node). The difficulty is how to manage sharing authentication between the two. Specifically anyone using the chat must have a valid token retrieved from the Flask API.

Can our Node app check the validity of the token if we have it setup with the same JWT secret as in the flask API?

If we find that a token is expired from the Node app, how can we manage refreshing the tokens?