An API receives a JWT from a Cognito user pool and must decide whether to accept it for its configured authorization flow. Which checks are necessary? Select 2 answers.

1. Check token use and the audience or client claims required for the specific token type and API flow.
2. Accept any base64-decodable payload as authenticated.
3. Ignore expiration whenever the token contains the desired email address.
4. Verify the signature against trusted current signing keys and validate expiration and expected issuer.
5. Trust a signing-key URL supplied only inside the untrusted token.