I am working on Identity server and OpenId connect and since I need to do the implementation in a more dynamic manner and on multiple microservices in different languages, I am trying to understand the flow and doing the implementation with different stacks without depending on the client SDKs provided by the particular Identity server provider we are using. (in production, most likely, we will use some already built libs but my intention now is to grasp the concept of verification from ground up)

Now I am trying to simulate a case where we already have the access and id tokens and they are sent to a simple REST PHP function, and:

* **Do verification of JWT signature**
* Expiration check on the token
* Validation of Scope & Audience
* Pass username back to the frontend

*(not relevant but I generated the access\_token with Authorisation code flow -> PKCE)*

This is my verification flow, I am using jose-php packages:

```
# public key
$components = array(
    'kty' => 'RSA',
    'e' => 'AQAB',
    'n' => 'x9vNhcvSrxjsegZAAo4OEuo...'
);

$public_key= JOSE_JWK::decode($components);

$jwt_string = 'eyJ...'; // Access_token
$jws = JOSE_JWT::decode($jwt_string);
$result = $jws->verify($public_key, 'RS256');

```

However, this returns undefined for $result. I am debugging other parts of the PHP script, and I will share my result with everyone here once I find a fix but I think there is a better way (not with provider exclusive client SDKs) to do this flow and there is a high chance that I am missing something.

**If anyone has a background with JWT token verification with PHP for identity server, It will be really great if you can share any better alternative or suggestions to do this here**

Thank you in advance :)