Shared key

I have two API servers A and B.

Server A has an authentication system, which grants a user an access token (JWT) to perform actions, and access restricted resources on server A.

I want server B to require the user to be an authenticated user from server A, in order to perform actions on server B.

Security wise, is it okay to have a shared JWT private key / secret on both server A and B to authenticate the user? If not, what would be the alternative?

Sensitive information

I am aware that JWT’s can be easily decoded, and therefore it shouldn’t contain sensitive information. Currently I am storing the user’s email and MongoDB _id in the JWT, is this considered sensitive information?