I am currently using JWT implementation for the authentication part of my APIs.
A private key is used to sign the token generated and used to make sure it's not tampered with when it's used later for other API.
My question is - What is the impact if this private key is leaked? What can the bad guy do with it?
From here, my understanding is that the payload can be altered. Hence, in that example, a normal user can be changed to admin. But in my scenario, I don't have any other important fields except expiration date.
So other than the bad guy able to forever extend his own token expiry date, what are the other impacts that I am facing?