Instead of sending the only the signed token I tried to send the hashed and signed token as id in a plain text token. Client will receive the token separate the id from the token and replace it with 'placeholder' . Then it will unsign the id which will give the hash token and then client will hash the plain text token and check it with the received hash data and send it to nova.