code: def _verify_iat_and_exp(payload):
      
      now = _helpers.datetime_to_secs(_helpers.utcnow())
  
      # Make sure the iat and exp claims are present.
      for key in ('iat', 'exp'):
          if key not in payload:
              raise ValueError(
                  'Token does not contain required claim {}'.format(key))
  
      # Make sure the token wasn't issued in the future.
      iat = payload['iat']
      # Err on the side of accepting a token that is slightly early to account
      # for clock skew.
      earliest = iat - _helpers.CLOCK_SKEW_SECS
      if now < earliest:
          raise ValueError('Token used too early, {} < {}'.format(now, iat))
  
      # Make sure the token wasn't issued in the past.
      exp = payload['exp']
      # Err on the side of accepting a token that is slightly out of date
      # to account for clow skew.
      latest = exp + _helpers.CLOCK_SKEW_SECS
      if latest < now:
          raise ValueError('Token expired, {} < {}'.format(latest, now))
docs: Verifies the ``iat`` (Issued At) and ``exp`` (Expires) claims in a token
      payload.
  
      Args:
          payload (Mapping[str, str]): The JWT payload.
  
      Raises:
          ValueError: if any checks failed.