title: How to verify the Signature of a JWT generated by AWS Cognito in Python 3.6?
body: <p>Here's my script</p>
  
  <pre><code>import urllib.request
  import json
  import time
  from jose import jwk, jwt
  from jose.utils import base64url_decode
  import base64
  
  
  region = '....'
  userpool_id = '.....'
  app_client_id = '...' 
  keys_url = 'https://cognito-idp.{}.amazonaws.com/{}/.well-known/jwks.json'.format(region, userpool_id)
  
  response = urllib.request.urlopen(keys_url)
  keys = json.loads(response.read())['keys']
  token = request.headers['Authorization']
  print(token)
  # get the kid from the headers prior to verification
  headers = jwt.get_unverified_headers(request.headers['Authorization'])
  kid = headers['kid']
  
  print(kid)
  # search for the kid in the downloaded public keys
  key_index = -1
  for i in range(len(keys)):
      if kid == keys[i]['kid']:
          key_index = i
          break
  if key_index == -1:
      print('Public key not found in jwks.json')
      return False
  # construct the public key
  public_key = jwk.construct(keys[key_index])
  # get the last two sections of the token,
  # message and signature (encoded in base64)
  message, encoded_signature = str(token).rsplit('.', 1)
  # decode the 
  print('&gt;&gt;encoded signature')
  print(encoded_signature)
  decoded_signature = base64.b64decode(encoded_signature)
  if not public_key.verify(message, decoded_signature):
      print('Signature verification failed')
      return False
  print('Signature successfully verified')
  </code></pre>
  
  <p>I am always ending up Signature verification failed even though  jwt token is generated by a valid legitimate cognito user pool. I've looked at the documentation and it does not really specify the whole verification process.</p>