code: public static void validateTokenString(String tokenString, String alg, @Sensitive Key key, long secondsClockSkew, boolean forSignatureOnly) throws InvalidJwtException {
  
          // alg is HS256 or RS256 which is consistent with AlgorithmIdentifiers
          AlgorithmConstraints algorithmConstraints = new AlgorithmConstraints(ConstraintType.WHITELIST,
                  alg);
  
          JwtConsumer firstPassJwtConsumer = new JwtConsumerBuilder()
                  .setSkipAllValidators()
                  .setDisableRequireSignature()
                  .setSkipSignatureVerification()
                  .build();
          JwtContext jwtContext = firstPassJwtConsumer.process(tokenString);
  
          JwtConsumerBuilder secondBuilder = new JwtConsumerBuilder()
                  .setVerificationKey(key)
                  .setJwsAlgorithmConstraints(algorithmConstraints)
                  .setRelaxVerificationKeyValidation() // relaxes hs256 key length reqmt. to be consistent w. old net.oauth behavior
                  .setSkipDefaultAudienceValidation();
  
          if (forSignatureOnly) {
              secondBuilder.setSkipAllValidators();
          } else {
              if (secondsClockSkew > Integer.MAX_VALUE) {
                  // before downcasting, truncate max clock skew to 68 years if it's greater than that.
                  secondsClockSkew = Integer.MAX_VALUE;
              }
              secondBuilder = secondBuilder.setAllowedClockSkewInSeconds((int) secondsClockSkew);
          }
  
          JwtConsumer secondPassJwtConsumer = secondBuilder.build();
          secondPassJwtConsumer.processContext(jwtContext);
      }
docs: check Signature, iat, and exp only, which is what the old net.oauth code used to do.
  Will throw an exception if the token fails to validate.
  
  @param tokenString
  @param alg
  @param key
  @param secondsClockSkew
  @param forSignatureOnly
  @throws InvalidJwtException