After receiving the transient token, validate its integrity using the public key embedded within the capture context created at the beginning of this flow. This verifies that issued the token and that no data tampering occurred during transit.

Example: Capture Context Public Key

{  "jwk": {    "kty": "RSA",    "e": "AQAB",    "use": "enc",    "n": "3DhDtIHLxsbsSygEAG1hcFqnw64khTIZ6w9W9mZNl83gIyj1FVk-H5GDMa85e8RZFxUwgU_zQ0kHLtONo8SB52Z0hsJVE9wqHNIRoloiNPGPQYVXQZw2S1BSPxBtCEjA5x_-bcG6aeJdsz_cAE7OrIYkJa5Fphg9_pxgYRod6JCFjgdHj0iDSQxtBsmtxagAGHjDhW7UoiIig71SN-f-gggaCpITem4zlb5kkRVvmKMUANe4B36v4XSSSpwdP_H5kv4JDz_cVlp_Vy8T3AfAbCtROyRyH9iH1Z-4Yy6T5hb-9y3IPD8vlc8E3JQ4qt6U46EeiKPH4KtcdokMPjqiuQ",    "kid": "00UaBe20jy9VkwZUQPZwNNoKFPJA4Qhc"  }}

Use the capture context public key to cryptographically validate the JWT provided from a successful /tokens call.

You might have to convert the JSON Web Key (JWK) to privacy-enhanced mail (PEM) format for compatibility with some JWT validation software libraries.