export interface GoogleOidcOptions {
    /**
     * The audience the token must be minted for: the subscription's configured
     * audience, which Pub/Sub defaults to the push endpoint URL.
     */
    audience: string;
    /**
     * The service account the push subscription authenticates as, checked with
     * `email_verified`. Required: anyone can mint a Google-signed token for any
     * audience, so only the account says the push came from your subscription.
     */
    email: string;
    /** Fetches Google's JWKS. Defaults to the global `fetch`. */
    fetch?: typeof fetch;
    /** Clock, for tests. Defaults to `Date.now`. */
    now?: () => number;
}
/** Accept `Authorization: Bearer <token>`, the header verbatim, or `?token=`. */
export declare const verifyToken: (req: Request, token: string) => void;
/** Throws `Invalid` unless `opts` names both an audience and a service account. */
export declare const checkGoogleOptions: (opts: GoogleOidcOptions) => void;
/**
 * A verifier for Google-signed OIDC tokens, caching the signing keys for an
 * hour. A key id it hasn't seen refetches them (Google rotates), at most once
 * a minute; concurrent requests share one fetch.
 */
export declare const googleOidcVerifier: (opts: GoogleOidcOptions) => ((req: Request) => Promise<void>);
//# sourceMappingURL=verify.d.ts.map