diff --git a/server/SecureToken.ts b/server/SecureToken.ts
index 87dd512..d715493 100644
--- a/server/SecureToken.ts
+++ b/server/SecureToken.ts
@@ -18,11 +18,11 @@ export type SecureEncryptedToken = {
     payload: string; //BASE64(AES(BSON(aad),BSON(payload)))
 }
 
-export type SecurePlaintextToken<T extends object> = {
+export type SecurePlaintextToken = {
     nonce: string; // [key, iv] = SHA512(presharedSecret + nonce)
     type: string; // aad[0]
     validUntil: string; // aad[1]
-    payload: T; // aad[2]
+    payload: string; // JSON => aad[2]
     tag: string; //BASE64(AES(BSON(aad),null)))
 }
 
@@ -102,7 +102,7 @@ export async function parseSecureEncryptedToken<T extends object>(secureToken: S
     return payload as T;
 }
 
-export async function generateSecurePlaintextToken<T extends object>(validUntil: Date, type: string, payload: T, presharedTokenSecret?: string): Promise<SecurePlaintextToken<T>> {
+export async function generateSecurePlaintextToken<T extends object>(validUntil: Date, type: string, payload: T, presharedTokenSecret?: string): Promise<SecurePlaintextToken> {
     if (!presharedTokenSecret) {
         if (!staticPresharedTokenSecret) {
             throw new Error("PRESHARED_TOKEN_SECRET is not set");
@@ -124,8 +124,9 @@ export async function generateSecurePlaintextToken<T extends object>(validUntil:
     const iv = new Uint8Array(keyBuffer.buffer, 32, 12);
 
     const validUntilText = validUntil.toISOString();
+    const jsonPayload = JSON.stringify(payload);
 
-    const aad = [type, validUntilText, payload];
+    const aad = [type, validUntilText, jsonPayload];
     const aadRaw = BSON.serialize(aad);
 
     const dummyPayload = new ArrayBuffer(0);
@@ -136,12 +137,12 @@ export async function generateSecurePlaintextToken<T extends object>(validUntil:
         nonce: nonce.toString('base64'),
         type,
         validUntil: validUntilText,
-        payload,
+        payload: jsonPayload,
         tag: tag.toString('base64'),
     }
 }
 
-export async function parseSecurePlaintextToken<T extends object>(secureToken: SecurePlaintextToken<T>, presharedTokenSecret?: string): Promise<T> {
+export async function parseSecurePlaintextToken<T extends object>(secureToken: SecurePlaintextToken, presharedTokenSecret?: string): Promise<T> {
     if (!presharedTokenSecret) {
         if (!staticPresharedTokenSecret) {
             throw new Error("PRESHARED_TOKEN_SECRET is not set");
@@ -167,5 +168,5 @@ export async function parseSecurePlaintextToken<T extends object>(secureToken: S
 
     await AES_GCM_Decrypt(key, iv, tag, aadRaw);
 
-    return secureToken.payload;
+    return JSON.parse(secureToken.payload);
 }
\ No newline at end of file