code: def decode(token, certs=None, verify=True, audience=None):
      
      header, payload, signed_section, signature = _unverified_decode(token)
  
      if not verify:
          return payload
  
      # If certs is specified as a dictionary of key IDs to certificates, then
      # use the certificate identified by the key ID in the token header.
      if isinstance(certs, collections.Mapping):
          key_id = header.get('kid')
          if key_id:
              if key_id not in certs:
                  raise ValueError(
                      'Certificate for key id {} not found.'.format(key_id))
              certs_to_check = [certs[key_id]]
          # If there's no key id in the header, check against all of the certs.
          else:
              certs_to_check = certs.values()
      else:
          certs_to_check = certs
  
      # Verify that the signature matches the message.
      if not crypt.verify_signature(signed_section, signature, certs_to_check):
          raise ValueError('Could not verify token signature.')
  
      # Verify the issued at and created times in the payload.
      _verify_iat_and_exp(payload)
  
      # Check audience.
      if audience is not None:
          claim_audience = payload.get('aud')
          if audience != claim_audience:
              raise ValueError(
                  'Token has wrong audience {}, expected {}'.format(
                      claim_audience, audience))
  
      return payload
docs: Decode and verify a JWT.
  
      Args:
          token (str): The encoded JWT.
          certs (Union[str, bytes, Mapping[str, Union[str, bytes]]]): The
              certificate used to validate the JWT signature. If bytes or string,
              it must the the public key certificate in PEM format. If a mapping,
              it must be a mapping of key IDs to public key certificates in PEM
              format. The mapping must contain the same key ID that's specified
              in the token's header.
          verify (bool): Whether to perform signature and claim validation.
              Verification is done by default.
          audience (str): The audience claim, 'aud', that this JWT should
              contain. If None then the JWT's 'aud' parameter is not verified.
  
      Returns:
          Mapping[str, str]: The deserialized JSON payload in the JWT.
  
      Raises:
          ValueError: if any verification checks failed.