I'm new to JWT and I'm having trouble with verifying the JWT when using the RS256 algorithm. I get error 403 every single time I try to verify the token, but I don't understand why. I'm certain I'm using the right key-files. I even tried writing : jwt.verify(publicKey, publicKey) and even with that I got error 403! Aren't they supposed to match each other exactly? What exactly is jwt.verify() doing? Is it checking if the first value is equal to the second value? Is it decoding the key?

This is how I sign the token:

 import fs from 'fs'

 const privateKey = fs.readFileSync('./private.pem', 'utf8')

 const accessToken = jwt.sign(payload, privateKey, {
        algorithm: 'RS256',
        expiresIn: '1h'
      })

And this is how I verify the token:

import createError from 'http-errors'

const authorize = (req, res, next) => {
const authorization = req.headers.authorization?.split(' ')
const publicKey = fs.readFileSync('./public.pem', 'utf8')

try {
  const payload = jwt.verify(authorization[1], publicKey)
  next()

} catch (err) {
   next(createError(403))
 }
}