atm the pub key of the provider is hard coded in the code.
we should grab the pub key from the iss value in jwt.token and request the value + /.well-known/jwks.json to get the pub key