JWT generation: reason for requiring both keys

:wave: hello there,

We’re integrating a self-hosted instance of Activepieces into our web application using the SDK Embed Builder.

To embed the Activepieces app, we need to generate a JWT. From what we understand, both the public and private keys are required to build this JWT.

We’re a bit confused about this — usually, only the private key is used to sign the token, and the public key is used by the verifying side.

Could you clarify why both are needed in this case?

Thanks in advance!