func (v *Verifier) verify(ctx context.Context, raw string, expectProxy bool) (jwt.Token, *User, error) {
	keys, err := v.cache.Get(ctx, v.jwksURL)
	if err != nil {
		if keys, err = v.cache.Refresh(ctx, v.jwksURL); err != nil {
			return nil, nil, &AuthError{Status: http.StatusUnauthorized, Code: "JWKS_UNAVAILABLE", Msg: "cannot fetch au1h keys: " + err.Error()}
		}
	}
	tok, err := jwt.Parse([]byte(raw),
		jwt.WithKeySet(keys),
		jwt.WithIssuer(v.url),
		jwt.WithAudience(v.appSlug),
		jwt.WithValidate(true),
	)
	if err != nil {
		code, status := "INVALID_TOKEN", http.StatusUnauthorized
		if errors.Is(err, jwt.ErrInvalidAudience()) {
			code, status = "WRONG_AUDIENCE", http.StatusForbidden
		}
		return nil, nil, &AuthError{Status: status, Code: code, Msg: "invalid token: " + err.Error()}
	}
	u := &User{
		ID:            tok.Subject(),
		Email:         claim(tok, "email"),
		Name:          claim(tok, "name"),
		ApplicationID: claim(tok, "applicationId"),
	}
	if u.ID == "" || u.Email == "" {
		return nil, nil, &AuthError{Status: http.StatusUnauthorized, Code: "INVALID_TOKEN", Msg: "token is missing sub or email"}
	}
	if isProxy := claim(tok, "typ") == ProxyTokenType; isProxy != expectProxy {
		msg := "a gateway proof token is not an access token"
		if !isProxy {
			msg = "x-au1h-token is not a gateway proof token"
		}
		return nil, nil, &AuthError{Status: http.StatusUnauthorized, Code: "WRONG_TOKEN_TYPE", Msg: msg}
	}
	return tok, u, nil
}