I had to use jwt.verify(cookie, process.env.SECRET_ACCESS_TOKEN, async (err, decoded) => { instead of jwt.verify(cookie, config.SECRET_ACCESS_TOKEN, async (err, decoded) => { in the verify.js file because config wasn't defined.

Amazing article