Verification of token signature, issuer, audience, expiration, and claims before granting API or service access.