10
I'm making my own google oauth implementation in PHP project. Everything works fine unless I'm trying to verify JWT received after the access token request (https://accounts.google.com/o/oauth2/token).
For JWT decoding I'm using firebase/php-jwt class.
It decodes perfectly, but if I switch on $verify option (decode() method 3-rd arg) I get : Signature verification failed exception thrown.
My guess is that, if I pass a wrong key to the decode() method. It's used later for hash_hmac() function when signature is generating done.
So my question is: What key exactly should I pass for signature verification to the Google OAuth JWT context?