import jwt

def validate_token(token):
    # BAD: Skip audience validation - using pattern the extractor detects
    options = {"validate_audience": False}
    return jwt.decode(token, key, algorithms=["HS256"], options=options)