I am new to JWT but need them for a third-party API - what is the best practice to handle/cache them?