curl --request POST \
  --url https://auth.yourdomain.com/oauth/token \
  --header 'content-type: application/json' \
  --data '{
    "client_id": "service-foo",
    "client_secret": "super-secret",
    "audience": "service-bar",
    "grant_type": "client_credentials"
  }'

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 86400,
  "token_type": "Bearer"
}

Authorization: Bearer <access_token>

const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const client = jwksClient({
  jwksUri: 'https://auth.yourdomain.com/.well-known/jwks.json'
});

function getKey(header, callback) {
  client.getSigningKey(header.kid, (err, key) => {
    callback(null, key.getPublicKey());
  });
}

function verifyToken(token) {
  return new Promise((resolve, reject) => {
    jwt.verify(token, getKey, {
      audience: 'service-bar',
      issuer: 'https://auth.yourdomain.com/',
      algorithms: ['RS256']
    }, (err, decoded) => {
      if (err) return reject(err);
      resolve(decoded);
    });
  });
}