Thanks for the code. I cleaned it up a bit for the next guy.

def verify(token) do
    with {:ok, jwk} <- get_jwk(token),
         {true, jose_jwt, _} = JOSE.JWT.verify(jwk, token),
         {_, claims} <- JOSE.JWT.to_map(jose_jwt) do
      {:ok, claims}
    end
  end

  def get_jwk(token) do
    with {:ok, %{body: body}} <- HTTPoison.get(@cert_url),
         {:ok, certs} <- Jason.decode(body),
         {:ok, header} <- Joken.peek_header(token) do
      jwk =
        certs
        |> JOSE.JWK.from_firebase()
        |> Map.get(header["kid"])
        |> JOSE.JWK.to_map()
        |> elem(1)

      {:ok, jwk}
    end
  end

I found the JOSE library

To finish up the code…

def verify(token) do
  {:ok, resp} = HTTPoison.get(@cert_url)
  %{body: body} = resp
  certs = Poison.Parser.parse!(body, %{})
  {:ok, header} = Joken.peek_header(token)
  jwks = JOSE.JWK.from_firebase(certs)
  jwk = jwks[header["kid"]] |> JOSE.JWK.to_map |> elem(1)
  {true, jose_jwt, _} = JOSE.JWT.verify(jwk, token)
  fields = JOSE.JWT.to_map(jose_jwt) |> elem(1)
  {:ok, fields}
end

Elixir code can probably be cleaned up