obligatory introduction

Hi, new to decompilation. Looking to reverse engineer the API for my national railway ticket booking android app (IRCTC Connect) since their client has major missing features. The app has a lot of protections (SSL Pinning, obfuscation, JWT encryption) and right now I'm trying to figure out how the JWT encryption works. Digging through .smali files is quite hard for me, and the jadx decompilation seems to be incorrect for a lot of function calls. Would like to know how to go about debugging .smali files and inserting debug statements (eg. breakpoints?). Thanks