An API uses JWT authentication. Which validation is necessary before trusting its identity claims?

1. Validate the signature and required issuer, audience, and time constraints.
2. Treat any three dot-separated strings as an authenticated user.
3. Use a resource tag as the signing secret automatically.
4. Decode the payload and trust it without cryptographic validation.