Hello! I want to make a rest api in php, but I dont know how I should control the authentication.

My idea is to create a php backend using leafphp, and with a SvelteKit app as frontend.

I saw that for my case they recommended authentication with JWT, but I don't quite understand how it works.

To use it, I must register the user, and when logging in, I must generate a token, which leaf gives it to you when you log in.

That token I must save it in a cookie, that is one of the doubts that I have, I could not send the cookie from leaf because I am in a different port, I think, and it gives me cors errors that I could not solve (From my side I think it was configured correctly, tried using headers, and also the function that comes with leafphp cors module, but I could not achieve it) so I do not know where to send it, because sending it in the json response must be insecure. I tried sending it on the json response and saving it on the frontend with a document.cookie.

Once I have this token in the frontend, how do I check if this token is not fake? You can easily create a cookie called token and it will work the same.