res.json( access_token: token, user: id: user.id, role: user.role ); );

Request:

const token = jwt.sign( sub: user.id, role: user.role , process.env.JWT_SECRET, expiresIn: '1h' );

Authorization: Bearer <same_jwt_from_login>

Response: