I’m using “jose” library for verifying and signing JWT tokens, “jose” requires the env secret key to be encoded using TextEncoder() but doesn’t somebody just need to run TextDecoder() on the encoded key to expose the env secret key?
I’m hearing from all tutorials you should of course use environment variables for your secret key but what’s the point when it’s exposed via TextEncoder anyway?

import { jwtVerify, SignJWT } from 'jose'

const verifyAndSignJWT = async () => {

   const encodedKey = new TextEncoder().encode(process.env.JWT_SECRET_KEY)
   const decodedKey = new TextDecoder().decode(encodedKey)
   console.log(key: decodedKey) // (key: 'mySecretKeyIsExposed')

   const token = request.cookies.get('accessToken')?.value
   const decryptedToken = await jwtVerify(token, encodedKey)
   const refreshToken = await new SignJWT(decryptedToken.payload)
      .setProtectedHeader({alg: 'HS256'})
      .setIssuedAt()
      .setExpirationTime('1d from now')
      .sign(encodedKey)
}