confused on validation of token on auth0 JWT java library

Question

I read public/private key is so you can

1. create JWT token with private / public key
2. hand out your public key only to 3rd parties
3. 3rd parties can now validate users JWT tokens via the public key

However, their example with private / public key requires the private key to validate which seems odd ->

String token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXUyJ9.eyJpc3MiOiJhdXRoMCJ9.AbIJTDMFc7yUa5MhvcP03nJPyCPzZtQcGEp-zWfOkEE";
RSAPublicKey publicKey = //Get the key instance
RSAPrivateKey privateKey = //Get the key instance
try {
    Algorithm algorithm = Algorithm.RSA256(publicKey, privateKey);
    JWTVerifier verifier = JWT.require(algorithm)
        .withIssuer("auth0")
        .build(); //Reusable verifier instance
    DecodedJWT jwt = verifier.verify(token);
} catch (JWTVerificationException exception){
    //Invalid signature/claims
}

Is there no way to validate with just the public key?

Answer 1

On this line:

Algorithm algorithm = Algorithm.RSA256(publicKey, privateKey);

pass the privateKey as null. Private keys are for signing.

Algorithm algorithm = Algorithm.RSA256(publicKey, null);