Decode & Verify Base64urlUInt-encoded RS256 Public Key from Google According to Google, to access the id_token it sends along with Access Tokens (for accessing their API), you must first validate the token using the RS256 Public Key available from this page. The public key responses look like this:

  {
   "kty": "RSA",
   "alg": "RS256",
   "use": "sig",
   "kid": "8c9eb968f73744eaed421e48010142bce51a067f",
   "n": "uweJ3hFY9wqZ6ZG-iSNhQwHtKCGl8G_jcQgGPjOrS-Rum3dyDjicqkAyfS8XDn480KD_TZ5m-lqBjqfimePu2_cH4URDPIwsqSzJI2_piEhaqnXRptIe5YB5imAL6iETKaOPjw284Fc7EdHK-ekHMn3AXjsy9AIErwAVw4-4ZXXwHbyQXJy1DyUB4ZzxiEvw_qkQmLdltmrNkLOw-Xh-C9UkTZ9NA58bYPBnxLwnAu_ggw_g_-hCAs6OvXZbAfFHhIGBLyjtdDLVrfXo1112QREB9d5sEds0bKZtJcD9afl4E7Ht6G-g3jNP2clAu6-6B-cIe4-j8Ph1uJDPkAmDfw",
   "e": "AQAB"
},


According to Google &amp; RFC Specification 7518, this is a Base64urlUInt-encoded RS256 Public key. The "n" parameter is the modulus, and the "e" parameter is the exponent. The rest are simply for verifying the algorithm itself, not pertaining to use of the Public Key for decryption/vaidation.

My Issue stems from the fact that this is not, from what I've read online, a standard RS256 Public Key. When trying to verify my IDtoken, it spits back ValueError: Could not deserialize key data. (The technology isn't important, but I'm using the pyJWT module in python). I know the problem isn't with the ID token, because if I skip validation I don't have a problem. This of course isn't suitable for a production environment.

I've tried converting it to regular Base64 by replacing '-' and '_' with '+' &amp; '/', respectively, along with adding '=' for padding. I even tried prefixing the '-----BEGIN PUBLIC KEY-----\n' string &amp; appending the similar string at the end, but to no avail. I also tried appending the "AQAB" exponent to the end of the modulus, again without any success.

I've also tried playing around with other public keys generated online &amp; those work fine. Even if I purposefully mistype them, I get a error stating it simply couldn't validate the token, instead of spitting back a weird ValueError.

So my question stands; Is there something wrong with the "public key" modulus/exponent Google is giving me, or in how I'm using/converting it? Am I missing steps? Any help is greatly appreciated as I'm new to this topic. Thanks in advance!!
Both values are unsigned, big endian values, encoded as base-64-url. Basically that means that there is no sign bit and that the most significant bit is all the way to the left (bit B_7 - zero based indexing - on byte index zero). So you first need to base-64-url decode the values and then convert them to a big number. Finally, you need to combine both big numbers to form the public key, by providing the numbers as modulus $n$ and exponent $e$.

If you cannot combine the numbers to a public key you may need to encode the public key as PKCS#1 public key or SubjectPublicKeyInfo, which is an X.509 structure. For both these operations you either need to create the encoding yourself (which is pretty hard) or you need to have access and understand how to use an ASN.1 library.



You may want to have a look at the RSA public key interface in the "hazmat" cryptography package, with load_rsa_public_numbers and public_bytes(encoding, format) with PEM and SubjectPublicKeyInfo.