code: private String unprotectPayload(String payload) throws IOException {
          try {
              JWEObject jweObject = JWEObject.deserialize(MessageSecurityHelper.base64UrltoString(payload));
              JWEHeader jweHeader = jweObject.jweHeader();
  
              if (!clientEncryptionKey.kid().equals(jweHeader.kid()) || !jweHeader.alg().equals("RSA-OAEP")
                      || !jweHeader.enc().equals("A128CBC-HS256")) {
                  throw new IOException("Invalid protected response");
              }
  
              byte[] key = MessageSecurityHelper.base64UrltoByteArray(jweObject.encryptedKey());
  
              RsaKey clientEncryptionRsaKey = new RsaKey(clientEncryptionKey.kid(), clientEncryptionKey.toRSA(true));
              byte[] aesKeyBytes = clientEncryptionRsaKey.decryptAsync(key, null, null, null, "RSA-OAEP").get();
  
              SymmetricKey aesKey = new SymmetricKey(UUID.randomUUID().toString(), aesKeyBytes);
              byte[] result = aesKey.decryptAsync(MessageSecurityHelper.base64UrltoByteArray(jweObject.cipherText()),
                      MessageSecurityHelper.base64UrltoByteArray(jweObject.iv()),
                      jweObject.originalProtected().getBytes(MESSAGE_ENCODING),
                      MessageSecurityHelper.base64UrltoByteArray(jweObject.tag()), "A128CBC-HS256").get();
  
              return new String(result, MESSAGE_ENCODING);
          } catch (ExecutionException e) {
              // unexpected;
              return null;
          } catch (InterruptedException e) {
              // unexpected;
              return null;
          } catch (NoSuchAlgorithmException e) {
              // unexpected;
              return null;
          }
      }
docs: Unencrypt encrypted payload.
  
  @param payload
  base64url serialized JWEObject.
  
  @return Unencrypted message.