require "jwt"

builder = JWT::Builder.new
builder.issuer = "me"
builder.subject = "subject"
builder.audience = "my-app"

builder.header["src"] = "multisite-1"
builder.payload["username"] = "flyingkitty2019"

jwt = builder.generate

jwt = JWT::Token.decode("eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1MjEwNjI1MjMsIm5iZiI6MTUyMTA1ODkyMywiaWF0IjoxNTIxMDU4OTIzLCJlbWFpbCI6ImpvaG5AZXhhbXBsZS5jb20ifQ==.MhN4Yiq5Ivevp-XHmPUdecpLWuRu2-IcgMHHfj7hR_VXQtIPqe54uuSwd2")

issuer = jwt.headers["iss"]
username = jwt.payload["username"]
# etc

jwt = JWT::Token.decode("eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1MjEwNjI1MjMsIm5iZiI6MTUyMTA1ODkyMywiaWF0IjoxNTIxMDU4OTIzLCJlbWFpbCI6ImpvaG5AZXhhbXBsZS5jb20ifQ==.MhN4Yiq5Ivevp-XHmPUdecpLWuRu2-IcgMHHfj7hR_VXQtIPqe54uuSwd2")


validator = JWT::Validator.new
validator.issuer = "must be me"
validator.custom "username" do | username |
  next(username == "the_only_allowed_username")
end

validator.validate(token) # Returns true or false
validator.validate(token, true) # true or raises an exception because in strict mode - this will supply a reason for the failure

jwt = JWT::Token.decode("eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1MjEwNjI1MjMsIm5iZiI6MTUyMTA1ODkyMywiaWF0IjoxNTIxMDU4OTIzLCJlbWFpbCI6ImpvaG5AZXhhbXBsZS5jb20ifQ==.MhN4Yiq5Ivevp-XHmPUdecpLWuRu2-IcgMHHfj7hR_VXQtIPqe54uuSwd2")

pem = "-----BEGIN RSA PUBLIC KEY----- #..."
rsa = OpenSSL::RSA.new(pem, true)

JWT::Verifier::RSA.verify(token, rsa, JWT::Algorithm::RS256)