Struct IdTokenVerifier 

pub struct IdTokenVerifier { /* private fields */ }

Verifies Google-signed ID tokens for one audience: the RS256 signature against Google’s signing keys, iss, aud, and exp, nbf and iat with 30 seconds of leeway.

Keys are fetched on first use and cached for the max-age of their response. A token signed with a key that is not cached causes a refetch, at most once every 30 seconds. When a fetch fails, cached keys stay in use until their max-age passes. Share one verifier, behind an Arc, across requests.

Implementations

impl IdTokenVerifier

pub fn new(audience: IdTokenAudience) -> Result<Self>

A verifier that fetches Google’s signing keys from https://www.googleapis.com/oauth2/v3/certs. Fails only when the HTTP client cannot be built.

pub fn with_keys_source( audience: IdTokenAudience, keys_source: impl IdTokenKeysSource + 'static, ) -> Self

A verifier that gets its signing keys from keys_source, such as a fixed local key in tests. The other checks are the same as new’s.

pub async fn verify( &self, token: &str, ) -> Result<VerifiedIdToken, IdTokenVerifyError>

Verifies token, the bearer token of an authorization header, and returns its claims.