the jwt isnt tampered with. imgur servers did not validate the decoded payload matched their fb app id. it says in the docs be sure too match on the app id because fb isn't going through the ceremony of checking that your oAuth key is registered to a specific app id and therefore only valid together. app id is considered arbitrary payload metadata in this sense.