code: def verify_token(self, token, **kwargs):
          
          nonce = kwargs.get('nonce')
  
          token = force_bytes(token)
          if self.OIDC_RP_SIGN_ALGO.startswith('RS'):
              if self.OIDC_RP_IDP_SIGN_KEY is not None:
                  key = self.OIDC_RP_IDP_SIGN_KEY
              else:
                  key = self.retrieve_matching_jwk(token)
          else:
              key = self.OIDC_RP_CLIENT_SECRET
  
          payload_data = self.get_payload_data(token, key)
  
          # The 'token' will always be a byte string since it's
          # the result of base64.urlsafe_b64decode().
          # The payload is always the result of base64.urlsafe_b64decode().
          # In Python 3 and 2, that's always a byte string.
          # In Python3.6, the json.loads() function can accept a byte string
          # as it will automagically decode it to a unicode string before
          # deserializing https://bugs.python.org/issue17909
          payload = json.loads(payload_data.decode('utf-8'))
          token_nonce = payload.get('nonce')
  
          if self.get_settings('OIDC_USE_NONCE', True) and nonce != token_nonce:
              msg = 'JWT Nonce verification failed.'
              raise SuspiciousOperation(msg)
          return payload
docs: Validate the token signature.