How do you validate JWT from Genesys Cloud implicit grant in React?

How do you actually validate a JWT from the Genesys Cloud implicit grant flow inside a React app? The implicit grant just dumps the token in the URL fragment. Parsing window.location.hash works fine. The iss field keeps showing up as https://api.mypurecloud.com/oauth/token instead of the expected domain. We’re spinning up a quick dashboard to monitor the WebSocket event stream, but the frontend needs to check the token before it ships anything over to our Rust ingestion service.

const parts = token.split('.');
const payload = JSON.parse(atob(parts[1]));
if (payload.exp < Date.now() / 1000) {
 console.warn('Token expired');
}

Also, the exp check trips way too early. I’m not sure if GC signs these tokens properly. The docs mention using jwks_uri for public key fetching. Trying to map that to a client-side check without pulling in a heavy crypto library feels messy. Just trying to keep the bundle size down. The aud claim is also coming back as a single string. That breaks the validation logic in our middleware. We’ve been debugging this for two hours. The signature verification keeps failing even when the payload looks valid.

Cause: The iss claim points to the token endpoint, not the API root. That’s standard OAuth2 behavior. You’re checking against the wrong string.

Solution: Validate against https://api.mypurecloud.com/oauth/token. Here’s a quick check.

if (payload.iss !== 'https://api.mypurecloud.com/oauth/token') throw new Error('Invalid issuer');