title: Which Key Do We Use When Verifying Google ID Tokens
body: <p>We're verifying a Google ID Token on ColdFusion servers.  We have everything working but one thing puzzles me:</p>
  <p>In the instructions <a href="https://developers.google.com/identity/gsi/web/guides/verify-google-id-token" rel="nofollow noreferrer">here</a> Google says to use their public keys to verify the token.  When we retrieve the keys, in the JSON object there are 2 of them.  Whether we grab the PEM or the JWT there are 2 keys.</p>
  <p>Example JWT:
  <a href="https://i.stack.imgur.com/fLwE4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fLwE4.png" alt="enter image description here" /></a></p>
  <p>Example PEM:
  <a href="https://i.stack.imgur.com/qvc3A.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qvc3A.png" alt="enter image description here" /></a></p>
  <p>How do we know which key to use?  Through testing we find that one works and we're able to decode the JWT to validate while the other doesn't.  Right now we're having to try both of them to see which one works.  Is there something we're missing that indicates which of these keys is the one to use?</p>