Have you considered a higher level library like authlib? It might take care of some of the validation code in _decode_oidc_jwt. Take a look here: https://docs.authlib.org/en/stable/oauth2/resource-server/flask.html

I have not until now. I think that would be a bigger lift for the codebase. Current IRI needs are basically to validate a signed JWT, check the issuer/aud/exp. I think Authlib provides a full set of server/client tooling. Do we need that?

I think minimizing boilerplate is usually a good idea. Here are two options:

1. don't know much about this one: https://fastapi-oidc.readthedocs.io/en/latest/
2. the "standard": joserfc with:
   1. import keyset (jwks): https://jose.authlib.org/en/recipes/cheatsheet/#key-sets-jwks
   2. decode/validate the jwt: https://jose.authlib.org/en/recipes/cheatsheet/#decode-verify-token (where the 'key' param is the jwks from the prev. step)