PyJWT 2

Apply the Python 3.14 prompt first, including its PyJWT verification policy and bounded JWKS retrieval. These rules cover PyJWT 2's JWT and JWS APIs on that baseline. Use a complete OAuth or OpenID Connect implementation for the surrounding protocol.

Verification APIs and options

• Use jwt.decode() or jwt.decode_complete() for JWT claims. jwt.api_jws.PyJWS.decode() verifies a JWS and returns payload bytes without JWT claim validation.
• Set security options through the documented options mapping and supported named arguments. The legacy verify argument does not enable verification, and unknown keyword arguments can produce a warning rather than enforce the requested control.
• Keep each verification profile's instance and options under trusted application control. Do not mutate shared PyJWT.options, mix diagnostic decoding with an authentication instance, or let request data select verify_* flags.
• Add required subject, issued-at, token ID, and application claims to options["require"] when the profile needs them. Presence checking does not establish a valid value; subject= alone does not require a missing sub, and verify_jti checks a present value's type rather than replay state.
• Use strict_aud=True with a trusted string audience when the protocol permits exactly one audience. Ordinary audience verification accepts a match within a list; do not apply strict mode to a profile that legitimately requires multiple audiences.
• Require iat and check a bounded maximum age in application code when freshness depends on issuance time.