title: How to verify token signature in Nimbus JOSE + JWT
body: <p>I have tokens going back and forth from server to client on each request for resource using <a href="http://connect2id.com/products/nimbus-jose-jwt/examples/jwt-with-rsa-signature" rel="noreferrer">Nimbus JOSE + JWT</a> </p>
  
  <p>Code for creating JWT token:</p>
  
  <pre><code>public class TokenProvider {
  
      String token = "";
  
      public String getToken(String email) {
          try {
              KeyPairGenerator keyGenerator = KeyPairGenerator.getInstance("RSA");
              keyGenerator.initialize(1024);
  
              KeyPair kp = keyGenerator.genKeyPair();
              RSAPublicKey publicKey = (RSAPublicKey) kp.getPublic();
              RSAPrivateKey privateKey = (RSAPrivateKey) kp.getPrivate();
  
              System.out.println("publicKey: " + publicKey);
              System.out.println("privateKey: " + privateKey.toString());
  
              JWSSigner signer = new RSASSASigner(privateKey);
  
              JWTClaimsSet claimsSet = new JWTClaimsSet();
              claimsSet.setSubject("RTH");
              claimsSet.setCustomClaim("email", email);
              claimsSet.setCustomClaim("role", "USER");
              claimsSet.setIssuer("https://rth.com");
              claimsSet.setExpirationTime(new Date(new Date().getTime() + 60 * 1000));
  
              SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), claimsSet);
  
              signedJWT.sign(signer);
              token = signedJWT.serialize();
              TokenSaverAndValidatorDAO tokenSaver = new TokenSaverAndValidatorDAO();
              tokenSaver.saveTokenToDB(email, token);
  
              signedJWT = SignedJWT.parse(token);
  
              JWSVerifier verifier = new RSASSAVerifier(publicKey);
              System.out.println("verifier: " + verifier);
              System.out.println("verify method: " + signedJWT.verify(verifier));
              assertTrue(signedJWT.verify(verifier));
              assertEquals("RTH", signedJWT.getJWTClaimsSet().getSubject());
              assertEquals("https://rth.com", signedJWT.getJWTClaimsSet().getIssuer());
              assertTrue(new Date().before(signedJWT.getJWTClaimsSet().getExpirationTime()));
          } catch (JOSEException | ParseException | NoSuchAlgorithmException ex) {
              Logger.getLogger(TokenProvider.class.getName()).log(Level.SEVERE, null, ex);
          }
          return token;
      }
  }
  </code></pre>
  
  <p>So far its working fine but the problem is how do I verify the token signature received back from client?</p>
  
  <p>From the <a href="http://connect2id.com/products/nimbus-jose-jwt/examples/jwt-with-rsa-signature" rel="noreferrer">API</a>, there is only one method which looks like it is for verification but its accepting only public Key (<code>RSAPublicKey</code>) as parameter rather than token.</p>
  
  <p>Anyone worked on JWT using this library please help. Thank you</p>