$provider->validateAccessToken($token);

$keys = $this->getJwtVerificationKeys();
(array)JWT::decode($accessToken, $keys, ['RS256'])

public static function decode($jwt, $key, array $allowed_algs = array())
    $tks = explode('.', $jwt);
    list($headb64, $bodyb64, $cryptob64) = $tks;
    $header = static::jsonDecode(static::urlsafeB64Decode($headb64))
    $sig = static::urlsafeB64Decode($cryptob64);
    $key = $key[$header->kid];

    static::verify("$headb64.$bodyb64", $sig, $key, $header->alg);

$obj = json_decode($input, false, 512, JSON_BIGINT_AS_STRING);

public static function urlsafeB64Decode($input)
    $remainder = strlen($input) % 4;
    if ($remainder) {
        $padlen = 4 - $remainder;
        $input .= str_repeat('=', $padlen);
    }
    return base64_decode(strtr($input, '-_', '+/'));

private static function verify($msg, $signature, $key, $alg)
    list($function, $algorithm) = static::$supported_algs[$alg]; // list('openssl', 'SHA256')
    openssl_verify($msg, $signature, $key, $algorithm);