def get_verified_jwt(
    providers, audiences,
    check_authorization_header=True, check_query_arg=True,
    request=None, cache=memcache):
  """
  This function will extract, verify, and parse a JWT token from the
  Authorization header or access_token query argument.

  The JWT is assumed to contain an issuer and audience claim, as well
  as issued-at and expiration timestamps. The signature will be
  cryptographically verified, the claims and timestamps will be
  checked, and the resulting parsed JWT body is returned.

  If at any point the JWT is missing or found to be invalid, the
  return result will be None.

  Arguments:
  providers - An iterable of dicts each containing 'issuer' and 'cert_uri' keys
  audiences - An iterable of valid audiences

  check_authorization_header - Boolean; check 'Authorization: Bearer' header
  check_query_arg - Boolean; check 'access_token' query arg

  request - Must be the request object if check_query_arg is true; otherwise ignored.
  cache - In testing, override the certificate cache
  """
  if not (check_authorization_header or check_query_arg):
      raise ValueError(
          'Either check_authorization_header or check_query_arg must be True.')
  if check_query_arg and request is None:
      raise ValueError(
          'Cannot check query arg without request object.')
  schemes = ('Bearer',) if check_authorization_header else ()
  keys = ('access_token',) if check_query_arg else ()
  token = _get_token(
      request=request, allowed_auth_schemes=schemes, allowed_query_keys=keys)
  if token is None:
    return None
  time_now = long(time.time())
  for provider in providers:
    parsed_token = _parse_and_verify_jwt(
        token, time_now, (provider['issuer'],), audiences, provider['cert_uri'], cache)
    if parsed_token is not None:
      return parsed_token
  return None
This function will extract, verify, and parse a JWT token from the
  Authorization header or access_token query argument.

  The JWT is assumed to contain an issuer and audience claim, as well
  as issued-at and expiration timestamps. The signature will be
  cryptographically verified, the claims and timestamps will be
  checked, and the resulting parsed JWT body is returned.

  If at any point the JWT is missing or found to be invalid, the
  return result will be None.

  Arguments:
  providers - An iterable of dicts each containing 'issuer' and 'cert_uri' keys
  audiences - An iterable of valid audiences

  check_authorization_header - Boolean; check 'Authorization: Bearer' header
  check_query_arg - Boolean; check 'access_token' query arg

  request - Must be the request object if check_query_arg is true; otherwise ignored.
  cache - In testing, override the certificate cache