Considering that the app is verifying the JWT access token with SciGateway Auth it means that it is fine to decode the JWT access token without validation when getting its payload. By doing this, the app will no longer have to use the public key from SciGateway Auth.