def get_verified_jwt(<EOL>providers, audiences,<EOL>check_authorization_header=True, check_query_arg=True,<EOL>request=None, cache=memcache):
if not (check_authorization_header or check_query_arg):<EOL><INDENT>raise ValueError(<EOL>'<STR_LIT>')<EOL><DEDENT>if check_query_arg and request is None:<EOL><INDENT>raise ValueError(<EOL>'<STR_LIT>')<EOL><DEDENT>schemes = ('<STR_LIT>',) if check_authorization_header else ()<EOL>keys = ('<STR_LIT>',) if check_query_arg else ()<EOL>token = _get_token(<EOL>request=request, allowed_auth_schemes=schemes, allowed_query_keys=keys)<EOL>if token is None:<EOL><INDENT>return None<EOL><DEDENT>time_now = int(time.time())<EOL>for provider in providers:<EOL><INDENT>parsed_token = _parse_and_verify_jwt(<EOL>token, time_now, (provider['<STR_LIT>'],), audiences, provider['<STR_LIT>'], cache)<EOL>if parsed_token is not None:<EOL><INDENT>return parsed_token<EOL><DEDENT><DEDENT>return None<EOL>
This function will extract, verify, and parse a JWT token from the
Authorization header or access_token query argument.

The JWT is assumed to contain an issuer and audience claim, as well
as issued-at and expiration timestamps. The signature will be
cryptographically verified, the claims and timestamps will be
checked, and the resulting parsed JWT body is returned.

If at any point the JWT is missing or found to be invalid, the
return result will be None.

Arguments:
providers - An iterable of dicts each containing 'issuer' and 'cert_uri' keys
audiences - An iterable of valid audiences

check_authorization_header - Boolean; check 'Authorization: Bearer' header
check_query_arg - Boolean; check 'access_token' query arg

request - Must be the request object if check_query_arg is true; otherwise ignored.
cache - In testing, override the certificate cache