I'm using JWT tokens to secure the API itself. But after I pass the token to the web API, I need to know which user is making the requests so I can apply the correct permissions and what not.

I thought of two different things:

• When I authenticate the user name and password, save the generated token to the DB with the ID of the user. This will allow me to join the token table onto the user table when requests are made to the API.
• When the token is passed to the client, also pass the user ID and require the user ID in the body of further requests.

I have no idea if either way is ideal or if there's a better way. So any assistance would be greatly appreciated.