def verify_token(token, issuer:, audience:, client_id:)
      header, payload = token.split('.').first(2).map{|encoded| JSON.parse(Base64.decode64(encoded))}

      # validate claims
      raise InvalidToken.new('Invalid issuer')    if payload['iss'] != issuer
      raise InvalidToken.new('Invalid audience')  if payload['aud'] != audience
      raise InvalidToken.new('Invalid client')    if !Array(client_id).include?(payload['cid'])
      raise InvalidToken.new('Token is expired')  if payload['exp'].to_i <= Time.now.to_i

      # validate signature
      jwk = JSON::JWK.new(get_jwk(header, payload))
      JSON::JWT.decode(token, jwk.to_key)
    end
def verify_token(token, issuer:, audience:, client_id:)
      header, payload = token.split('.').first(2).map{|encoded| JSON.parse(Base64.decode64(encoded))}

      # validate claims
      raise InvalidToken.new('Invalid issuer')    if payload['iss'] != issuer
      raise InvalidToken.new('Invalid audience')  if payload['aud'] != audience
      raise InvalidToken.new('Invalid client')    if !Array(client_id).include?(payload['cid'])
      raise InvalidToken.new('Token is expired')  if payload['exp'].to_i <= Time.now.to_i

      # validate signature
      jwk = JSON::JWK.new(get_jwk(header, payload))
      JSON::JWT.decode(token, jwk.to_key)
    end
validate the token