JWT — what does full token verification look like?
Answer out loud or in your head first, then compare.
Answer
JWT is a format for carrying claims. A signed token lets you check integrity, but its payload can usually be read without the secret.
Flow: after login the server issues a token; on every request the API verifies the signature, the allowed algorithm, the expiry and required claims, e.g. issuer and audience. Only then does it check permissions for the resource.
To be precise: decoding alone doesn't verify the signature. Logout, rotation and revocation need a separate design. Where the token is stored affects protection against XSS and CSRF.
Pitfall: I don't put secrets in the payload. JWT doesn't automatically give you secure authorisation, nor does it replace HTTPS.
How did it go? Be honest — “Not yet” puts the question on your review list.