diff --git a/lti_consumer/lti_1p3/key_handlers.py b/lti_consumer/lti_1p3/key_handlers.py
index 78601e7f..c9e63c9a 100644
--- a/lti_consumer/lti_1p3/key_handlers.py
+++ b/lti_consumer/lti_1p3/key_handlers.py
@@ -4,17 +4,15 @@
 This handles validating messages sent by the tool and generating
 access token with LTI scopes.
 """
-import codecs
 import copy
-import time
 import json
+import math
+import time
+import sys
 import logging
 
+import jwt
 from Cryptodome.PublicKey import RSA
-from jwkest import BadSignature, BadSyntax, WrongNumberOfParts, jwk
-from jwkest.jwk import RSAKey, load_jwks_from_url
-from jwkest.jws import JWS, NoSuitableSigningKeys, UnknownAlgorithm
-from jwkest.jwt import JWT
 
 from . import exceptions
 
@@ -50,14 +48,9 @@ def __init__(self, public_key=None, keyset_url=None):
         # Import from public key
         if public_key:
             try:
-                new_key = RSAKey(use='sig')
-
-                # Unescape key before importing it
-                raw_key = codecs.decode(public_key, 'unicode_escape')
-
                 # Import Key and save to internal state
-                new_key.load_key(RSA.import_key(raw_key))
-                self.public_key = new_key
+                algo_obj = jwt.get_algorithm_by_name('RS256')
+                self.public_key = algo_obj.prepare_key(public_key)
             except ValueError as err:
                 log.warning(
                     'An error was encountered while loading the LTI tool\'s key from the public key. '
@@ -76,7 +69,7 @@ def _get_keyset(self, kid=None):
 
         if self.keyset_url:
             try:
-                keys = load_jwks_from_url(self.keyset_url)
+                keys = jwt.PyJWKClient(self.keyset_url).get_jwk_set()
             except Exception as err:
                 # Broad Exception is required here because jwkest raises
                 # an Exception object explicitly.
@@ -89,13 +82,13 @@ def _get_keyset(self, kid=None):
                 raise exceptions.NoSuitableKeys() from err
             keyset.extend(keys)
 
-        if self.public_key and kid:
-            # Fill in key id of stored key.
-            # This is needed because if the JWS is signed with a
-            # key with a kid, pyjwkest doesn't match them with
-            # keys without kid (kid=None) and fails verification
-            self.public_key.kid = kid
-
+        if self.public_key:
+            if kid:
+                # Fill in key id of stored key.
+                # This is needed because if the JWS is signed with a
+                # key with a kid, pyjwkest doesn't match them with
+                # keys without kid (kid=None) and fails verification
+                self.public_key.kid = kid
             # Add to keyset
             keyset.append(self.public_key)
 
@@ -111,48 +104,24 @@ def validate_and_decode(self, token):
         iss, sub, exp, aud and jti claims.
         """
         try:
-            # Get KID from JWT header
-            jwt = JWT().unpack(token)
-
-            # Verify message signature
-            message = JWS().verify_compact(
-                token,
-                keys=self._get_keyset(
-                    jwt.headers.get('kid')
-                )
-            )
-
-            # If message is valid, check expiration from JWT
-            if 'exp' in message and message['exp'] < time.time():
-                log.warning(
-                    'An error was encountered while verifying the OAuth 2.0 Client-Credentials Grant JWT. '
-                    'The JWT has expired.'
-                )
-                raise exceptions.TokenSignatureExpired()
-
-            # TODO: Validate other JWT claims
-
-            # Else returns decoded message
-            return message
-
-        except NoSuitableSigningKeys as err:
-            log.warning(
-                'An error was encountered while verifying the OAuth 2.0 Client-Credentials Grant JWT. '
-                'There is no suitable signing key.'
-            )
-            raise exceptions.NoSuitableKeys() from err
-        except (BadSyntax, WrongNumberOfParts) as err:
-            log.warning(
-                'An error was encountered while verifying the OAuth 2.0 Client-Credentials Grant JWT. '
-                'The JWT is malformed.'
-            )
-            raise exceptions.MalformedJwtToken() from err
-        except BadSignature as err:
-            log.warning(
-                'An error was encountered while verifying the OAuth 2.0 Client-Credentials Grant JWT. '
-                'The JWT signature is incorrect.'
-            )
-            raise exceptions.BadJwtSignature() from err
+            key_set = self._get_keyset()
+            if not key_set:
+                raise exceptions.NoSuitableKeys()
+            for i in range(len(key_set)):
+                try:
+                    message = jwt.decode(
+                            token,
+                            key=key_set[i],
+                            algorithms=['RS256', 'RS512',],
+                            options={'verify_signature': True}
+                        )
+                    return message
+                except Exception:
+                    if i == len(key_set) - 1:
+                        raise
+        except Exception as token_error:
+            exc_info = sys.exc_info()
+            raise jwt.InvalidTokenError(exc_info[2]) from token_error
 
 
 class PlatformKeyHandler:
@@ -171,14 +140,8 @@ def __init__(self, key_pem, kid=None):
         if key_pem:
             # Import JWK from RSA key
             try:
-                self.key = RSAKey(
-                    # Using the same key ID as client id
-                    # This way we can easily serve multiple public
-                    # keys on the same endpoint and keep all
-                    # LTI 1.3 blocks working
-                    kid=kid,
-                    key=RSA.import_key(key_pem)
-                )
+                algo = jwt.get_algorithm_by_name('RS256')
+                self.key = algo.prepare_key(key_pem)
             except ValueError as err:
                 log.warning(
                     'An error was encountered while loading the LTI platform\'s key. '
@@ -203,41 +166,26 @@ def encode_and_sign(self, message, expiration=None):
         # Set iat and exp if expiration is set
         if expiration:
             _message.update({
-                "iat": int(round(time.time())),
-                "exp": int(round(time.time()) + expiration),
+                "iat": int(math.floor(time.time())),
+                "exp": int(math.floor(time.time()) + expiration),
             })
 
         # The class instance that sets up the signing operation
         # An RS 256 key is required for LTI 1.3
-        _jws = JWS(_message, alg="RS256", cty="JWT")
-
-        try:
-            # Encode and sign LTI message
-            return _jws.sign_compact([self.key])
-        except NoSuitableSigningKeys as err:
-            log.warning(
-                'An error was encountered while signing the OAuth 2.0 access token JWT. '
-                'There is no suitable signing key.'
-            )
-            raise exceptions.NoSuitableKeys() from err
-        except UnknownAlgorithm as err:
-            log.warning(
-                'An error was encountered while signing the OAuth 2.0 access token JWT. '
-                'There algorithm is unknown.'
-            )
-            raise exceptions.MalformedJwtToken() from err
+        return jwt.encode(_message, self.key, algorithm="RS256")
 
     def get_public_jwk(self):
         """
         Export Public JWK
         """
-        public_keys = jwk.KEYS()
+        jwk = {"keys": []}
 
         # Only append to keyset if a key exists
         if self.key:
-            public_keys.append(self.key)
-
-        return json.loads(public_keys.dump_jwks())
+            algo_obj = jwt.get_algorithm_by_name('RS256')
+            public_key = algo_obj.prepare_key(self.key).public_key()
+            jwk['keys'].append(json.loads(algo_obj.to_jwk(public_key)))
+        return jwk
 
     def validate_and_decode(self, token, iss=None, aud=None):
         """
@@ -246,49 +194,22 @@ def validate_and_decode(self, token, iss=None, aud=None):
         Validates a token sent by the tool using the platform's RSA Key.
         Optionally validate iss and aud claims if provided.
         """
+        if not self.key:
+            raise exceptions.RsaKeyNotSet()
         try:
-            # Verify message signature
-            message = JWS().verify_compact(token, keys=[self.key])
-
-            # If message is valid, check expiration from JWT
-            if 'exp' in message and message['exp'] < time.time():
-                log.warning(
-                    'An error was encountered while verifying the OAuth 2.0 access token. '
-                    'The JWT has expired.'
-                )
-                raise exceptions.TokenSignatureExpired()
-
-            # Validate issuer claim (if present)
-            log_message_base = 'An error was encountered while verifying the OAuth 2.0 access token. '
-            if iss:
-                if 'iss' not in message or message['iss'] != iss:
-                    error_message = 'The required iss claim is missing or does not match the expected iss value. '
-                    log_message = log_message_base + error_message
-
-                    log.warning(log_message)
-                    raise exceptions.InvalidClaimValue(error_message)
-
-            # Validate audience claim (if present)
-            if aud:
-                if 'aud' not in message or aud not in message['aud']:
-                    error_message = 'The required aud claim is missing.'
-                    log_message = log_message_base + error_message
-
-                    log.warning(log_message)
-                    raise exceptions.InvalidClaimValue(error_message)
-
-            # Else return token contents
+            message = jwt.decode(
+                            token,
+                            key=self.key.public_key(),
+                            audience=aud,
+                            issuer=iss,
+                            algorithms=['RS256', 'RS512'],
+                            options={
+                                'verify_signature': True,
+                                'verify_aud': True if aud else False
+                            }
+                        )
             return message
 
-        except NoSuitableSigningKeys as err:
-            log.warning(
-                'An error was encountered while verifying the OAuth 2.0 access token. '
-                'There is no suitable signing key.'
-            )
-            raise exceptions.NoSuitableKeys() from err
-        except BadSyntax as err:
-            log.warning(
-                'An error was encountered while verifying the OAuth 2.0 access token. '
-                'The JWT is malformed.'
-            )
-            raise exceptions.MalformedJwtToken() from err
+        except Exception as token_error:
+            exc_info = sys.exc_info()
+            raise jwt.InvalidTokenError(exc_info[2]) from token_error
diff --git a/lti_consumer/lti_1p3/tests/test_consumer.py b/lti_consumer/lti_1p3/tests/test_consumer.py
index c261502a..fa7fb1af 100644
--- a/lti_consumer/lti_1p3/tests/test_consumer.py
+++ b/lti_consumer/lti_1p3/tests/test_consumer.py
@@ -2,18 +2,18 @@
 Unit tests for LTI 1.3 consumer implementation
 """
 
-import json
 from unittest.mock import patch
 from urllib.parse import parse_qs, urlparse
 import uuid
 
 import ddt
+import jwt
+import sys
 from Cryptodome.PublicKey import RSA
 from django.conf import settings
 from django.test.testcases import TestCase
 from edx_django_utils.cache import get_cache_key, TieredCache
-from jwkest.jwk import load_jwks
-from jwkest.jws import JWS
+from jwt.api_jwk import PyJWKSet
 
 from lti_consumer.data import Lti1p3LaunchData
 from lti_consumer.lti_1p3 import exceptions
@@ -36,7 +36,9 @@
 STATE = "ABCD"
 # Consider storing a fixed key
 RSA_KEY_ID = "1"
-RSA_KEY = RSA.generate(2048).export_key('PEM')
+RSA_KEY = RSA.generate(2048)
+RSA_PRIVATE_KEY = RSA_KEY.export_key('PEM')
+RSA_PUBLIC_KEY = RSA_KEY.public_key().export_key('PEM')
 
 
 def _generate_token_request_data(token, scope):
@@ -69,11 +71,11 @@ def setUp(self):
             lti_launch_url=LAUNCH_URL,
             client_id=CLIENT_ID,
             deployment_id=DEPLOYMENT_ID,
-            rsa_key=RSA_KEY,
+            rsa_key=RSA_PRIVATE_KEY,
             rsa_key_id=RSA_KEY_ID,
             redirect_uris=REDIRECT_URIS,
             # Use the same key for testing purposes
-            tool_key=RSA_KEY
+            tool_key=RSA_PUBLIC_KEY
         )
 
     def _setup_lti_launch_data(self):
@@ -118,9 +120,25 @@ def _decode_token(self, token):
         This also tests the public keyset function.
         """
         public_keyset = self.lti_consumer.get_public_keyset()
-        key_set = load_jwks(json.dumps(public_keyset))
-
-        return JWS().verify_compact(token, keys=key_set)
+        keyset = PyJWKSet.from_dict(public_keyset).keys
+
+        for i in range(len(keyset)):
+            try:
+                message = jwt.decode(
+                                token,
+                                key=keyset[i].key,
+                                algorithms=['RS256', 'RS512'],
+                                options={
+                                    'verify_signature': True,
+                                    'verify_aud': False
+                                }
+                            )
+                return message
+            except Exception as token_error:
+                if i < len(keyset) - 1:
+                    continue
+                exc_info = sys.exc_info()
+                raise jwt.InvalidTokenError(exc_info[2]) from token_error
 
     @ddt.data(
         ({"client_id": CLIENT_ID, "redirect_uri": LAUNCH_URL, "nonce": STATE, "state": STATE}, True),
@@ -558,7 +576,7 @@ def test_access_token_invalid_jwt(self):
         """
         request_data = _generate_token_request_data("invalid_jwt", "")
 
-        with self.assertRaises(exceptions.MalformedJwtToken):
+        with self.assertRaises(jwt.exceptions.InvalidTokenError):
             self.lti_consumer.access_token(request_data)
 
     def test_access_token_no_acs(self):
@@ -686,11 +704,11 @@ def setUp(self):
             lti_launch_url=LAUNCH_URL,
             client_id=CLIENT_ID,
             deployment_id=DEPLOYMENT_ID,
-            rsa_key=RSA_KEY,
+            rsa_key=RSA_PRIVATE_KEY,
             rsa_key_id=RSA_KEY_ID,
             redirect_uris=REDIRECT_URIS,
             # Use the same key for testing purposes
-            tool_key=RSA_KEY
+            tool_key=RSA_PUBLIC_KEY
         )
 
         self.preflight_response = {}
@@ -930,11 +948,11 @@ def setUp(self):
             lti_launch_url=LAUNCH_URL,
             client_id=CLIENT_ID,
             deployment_id=DEPLOYMENT_ID,
-            rsa_key=RSA_KEY,
+            rsa_key=RSA_PRIVATE_KEY,
             rsa_key_id=RSA_KEY_ID,
             redirect_uris=REDIRECT_URIS,
             # Use the same key for testing purposes
-            tool_key=RSA_KEY
+            tool_key=RSA_PUBLIC_KEY
         )
 
         self.preflight_response = {}
diff --git a/lti_consumer/lti_1p3/tests/test_key_handlers.py b/lti_consumer/lti_1p3/tests/test_key_handlers.py
index 43b5ffc5..bc5710aa 100644
--- a/lti_consumer/lti_1p3/tests/test_key_handlers.py
+++ b/lti_consumer/lti_1p3/tests/test_key_handlers.py
@@ -3,9 +3,12 @@
 """
 
 import json
+import math
+import time
 from unittest.mock import patch
 
 import ddt
+import jwt
 from Cryptodome.PublicKey import RSA
 from django.test.testcases import TestCase
 from jwkest import BadSignature
@@ -131,18 +134,17 @@ def test_empty_rsa_key(self):
             {'keys': []}
         )
 
-    # pylint: disable=unused-argument
-    @patch('time.time', return_value=1000)
-    def test_validate_and_decode(self, mock_time):
+    def test_validate_and_decode(self):
         """
         Test validate and decode with all parameters.
         """
+        expiration = 1000
         signed_token = self.key_handler.encode_and_sign(
             {
                 "iss": "test-issuer",
                 "aud": "test-aud",
             },
-            expiration=1000
+            expiration=expiration
         )
 
         self.assertEqual(
@@ -150,14 +152,12 @@ def test_validate_and_decode(self, mock_time):
             {
                 "iss": "test-issuer",
                 "aud": "test-aud",
-                "iat": 1000,
-                "exp": 2000
+                "iat": int(math.floor(time.time())),
+                "exp": int(math.floor(time.time()) + expiration),
             }
         )
 
-    # pylint: disable=unused-argument
-    @patch('time.time', return_value=1000)
-    def test_validate_and_decode_expired(self, mock_time):
+    def test_validate_and_decode_expired(self):
         """
         Test validate and decode with all parameters.
         """
@@ -166,7 +166,7 @@ def test_validate_and_decode_expired(self, mock_time):
             expiration=-10
         )
 
-        with self.assertRaises(exceptions.TokenSignatureExpired):
+        with self.assertRaises(jwt.InvalidTokenError):
             self.key_handler.validate_and_decode(signed_token)
 
     def test_validate_and_decode_invalid_iss(self):
@@ -175,7 +175,7 @@ def test_validate_and_decode_invalid_iss(self):
         """
         signed_token = self.key_handler.encode_and_sign({"iss": "wrong"})
 
-        with self.assertRaises(exceptions.InvalidClaimValue):
+        with self.assertRaises(jwt.InvalidTokenError):
             self.key_handler.validate_and_decode(signed_token, iss="right")
 
     def test_validate_and_decode_invalid_aud(self):
@@ -184,14 +184,14 @@ def test_validate_and_decode_invalid_aud(self):
         """
         signed_token = self.key_handler.encode_and_sign({"aud": "wrong"})
 
-        with self.assertRaises(exceptions.InvalidClaimValue):
+        with self.assertRaises(jwt.InvalidTokenError):
             self.key_handler.validate_and_decode(signed_token, aud="right")
 
     def test_validate_and_decode_no_jwt(self):
         """
         Test validate and decode with invalid JWT.
         """
-        with self.assertRaises(exceptions.MalformedJwtToken):
+        with self.assertRaises(jwt.InvalidTokenError):
             self.key_handler.validate_and_decode("1.2.3")
 
     def test_validate_and_decode_no_keys(self):
@@ -199,10 +199,10 @@ def test_validate_and_decode_no_keys(self):
         Test validate and decode when no keys are available.
         """
         signed_token = self.key_handler.encode_and_sign({})
-        # Changing the KID so it doesn't match
-        self.key_handler.key.kid = "invalid_kid"
 
-        with self.assertRaises(exceptions.NoSuitableKeys):
+        self.key_handler.key = None
+
+        with self.assertRaises(exceptions.RsaKeyNotSet):
             self.key_handler.validate_and_decode(signed_token)
 
 
@@ -217,12 +217,10 @@ def setUp(self):
         self.rsa_key_id = "1"
 
         # Generate RSA and save exports
-        rsa_key = RSA.generate(2048)
-        self.key = RSAKey(
-            key=rsa_key,
-            kid=self.rsa_key_id
-        )
-        self.public_key = rsa_key.publickey().export_key()
+        rsa_key = RSA.generate(2048).export_key('PEM')
+        algo_obj = jwt.get_algorithm_by_name('RS256')
+        self.key = algo_obj.prepare_key(rsa_key)
+        self.public_key = self.key.public_key()
 
         # Key handler
         self.key_handler = None
@@ -272,9 +270,7 @@ def test_get_keyset_with_pub_key(self):
             self.rsa_key_id
         )
 
-    # pylint: disable=unused-argument
-    @patch('time.time', return_value=1000)
-    def test_validate_and_decode(self, mock_time):
+    def test_validate_and_decode(self):
         """
         Check that the validate and decode works.
         """
@@ -283,7 +279,7 @@ def test_validate_and_decode(self, mock_time):
         message = {
             "test": "test_message",
             "iat": 1000,
-            "exp": 1200,
+            "exp": int(math.floor(time.time()) + 1000),
         }
         signed = create_jwt(self.key, message)
 
@@ -291,9 +287,7 @@ def test_validate_and_decode(self, mock_time):
         decoded_message = self.key_handler.validate_and_decode(signed)
         self.assertEqual(decoded_message, message)
 
-    # pylint: disable=unused-argument
-    @patch('time.time', return_value=1000)
-    def test_validate_and_decode_expired(self, mock_time):
+    def test_validate_and_decode_expired(self):
         """
         Check that the validate and decode raises when signature expires.
         """
@@ -307,7 +301,7 @@ def test_validate_and_decode_expired(self, mock_time):
         signed = create_jwt(self.key, message)
 
         # Decode and check results
-        with self.assertRaises(exceptions.TokenSignatureExpired):
+        with self.assertRaises(jwt.InvalidTokenError):
             self.key_handler.validate_and_decode(signed)
 
     def test_validate_and_decode_no_keys(self):
@@ -324,14 +318,13 @@ def test_validate_and_decode_no_keys(self):
         signed = create_jwt(self.key, message)
 
         # Decode and check results
-        with self.assertRaises(exceptions.NoSuitableKeys):
+        with self.assertRaises(jwt.InvalidTokenError):
             key_handler.validate_and_decode(signed)
 
-    @patch("lti_consumer.lti_1p3.key_handlers.JWS.verify_compact")
-    def test_validate_and_decode_bad_signature(self, mock_verify_compact):
-        mock_verify_compact.side_effect = BadSignature()
-
-        key_handler = ToolKeyHandler()
+    @patch("lti_consumer.lti_1p3.key_handlers.jwt.decode")
+    def test_validate_and_decode_bad_signature(self, mock_jwt_decode):
+        mock_jwt_decode.side_effect = Exception()
+        self._setup_key_handler()
 
         message = {
             "test": "test_message",
@@ -340,6 +333,5 @@ def test_validate_and_decode_bad_signature(self, mock_verify_compact):
         }
         signed = create_jwt(self.key, message)
 
-        # Decode and check results
-        with self.assertRaises(exceptions.BadJwtSignature):
-            key_handler.validate_and_decode(signed)
+        with self.assertRaises(jwt.InvalidTokenError):
+            self.key_handler.validate_and_decode(signed)
diff --git a/lti_consumer/lti_1p3/tests/utils.py b/lti_consumer/lti_1p3/tests/utils.py
index 3a76d162..3aae56ca 100644
--- a/lti_consumer/lti_1p3/tests/utils.py
+++ b/lti_consumer/lti_1p3/tests/utils.py
@@ -1,12 +1,14 @@
 """
 Test utils
 """
-from jwkest.jws import JWS
+import jwt
 
 
 def create_jwt(key, message):
     """
     Uses private key to create a JWS from a dict.
     """
-    jws = JWS(message, alg="RS256", cty="JWT")
-    return jws.sign_compact([key])
+    token = jwt.encode(
+        message, key, algorithm='RS256'
+    )
+    return token
diff --git a/lti_consumer/plugin/views.py b/lti_consumer/plugin/views.py
index c5436c2d..50519179 100644
--- a/lti_consumer/plugin/views.py
+++ b/lti_consumer/plugin/views.py
@@ -2,8 +2,10 @@
 LTI consumer plugin passthrough views
 """
 import logging
+import sys
 import urllib
 
+import jwt
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import PermissionDenied, ValidationError
@@ -16,7 +18,6 @@
 from django.views.decorators.http import require_http_methods
 from django_filters.rest_framework import DjangoFilterBackend
 from edx_django_utils.cache import TieredCache, get_cache_key
-from jwkest.jwt import JWT, BadSyntax
 from opaque_keys import InvalidKeyError
 from opaque_keys.edx.keys import UsageKey
 from rest_framework import status, viewsets
@@ -468,20 +469,22 @@ def access_token_endpoint(
             ))
         )
         return JsonResponse(token)
-
-    # Handle errors and return a proper response
-    except MissingRequiredClaim:
-        # Missing request attibutes
-        return JsonResponse({"error": "invalid_request"}, status=HTTP_400_BAD_REQUEST)
-    except (MalformedJwtToken, TokenSignatureExpired):
-        # Triggered when a invalid grant token is used
-        return JsonResponse({"error": "invalid_grant"}, status=HTTP_400_BAD_REQUEST)
-    except (NoSuitableKeys, UnknownClientId):
-        # Client ID is not registered in the block or
-        # isn't possible to validate token using available keys.
-        return JsonResponse({"error": "invalid_client"}, status=HTTP_400_BAD_REQUEST)
-    except UnsupportedGrantType:
-        return JsonResponse({"error": "unsupported_grant_type"}, status=HTTP_400_BAD_REQUEST)
+    except Exception as token_error:
+        exc_info = sys.exc_info()
+
+        # Handle errors and return a proper response
+        if exc_info[0] == MissingRequiredClaim:
+            # Missing request attributes
+            return JsonResponse({"error": "invalid_request"}, status=HTTP_400_BAD_REQUEST)
+        elif exc_info[0] in (MalformedJwtToken, TokenSignatureExpired, jwt.InvalidTokenError):
+            # Triggered when a invalid grant token is used
+            return JsonResponse({"error": "invalid_grant"}, status=HTTP_400_BAD_REQUEST)
+        elif exc_info[0] == UnsupportedGrantType:
+            return JsonResponse({"error": "unsupported_grant_type"}, status=HTTP_400_BAD_REQUEST)
+        else:
+            # Client ID is not registered in the block or
+            # isn't possible to validate token using available keys.
+            return JsonResponse({"error": "invalid_client"}, status=HTTP_400_BAD_REQUEST)
 
 
 # Post from external tool that doesn't
@@ -861,13 +864,12 @@ def start_proctoring_assessment_endpoint(request):
     token = request.POST.get('JWT')
 
     try:
-        jwt = JWT().unpack(token)
-    except BadSyntax:
+        decoded_jwt = jwt.decode(token, options={'verify_signature': False})
+    except Exception:
         return render(request, 'html/lti_proctoring_start_error.html', status=HTTP_400_BAD_REQUEST)
 
-    jwt_payload = jwt.payload()
-    iss = jwt_payload.get('iss')
-    resource_link_id = jwt_payload.get('https://purl.imsglobal.org/spec/lti/claim/resource_link', {}).get('id')
+    iss = decoded_jwt.get('iss')
+    resource_link_id = decoded_jwt.get('https://purl.imsglobal.org/spec/lti/claim/resource_link', {}).get('id')
 
     try:
         lti_config = LtiConfiguration.objects.get(lti_1p3_client_id=iss)
diff --git a/lti_consumer/tests/unit/plugin/test_proctoring.py b/lti_consumer/tests/unit/plugin/test_proctoring.py
index 67da1001..5f4e8167 100644
--- a/lti_consumer/tests/unit/plugin/test_proctoring.py
+++ b/lti_consumer/tests/unit/plugin/test_proctoring.py
@@ -137,8 +137,8 @@ def test_valid_token(self):
 
     def test_unparsable_token(self):
         """Tests that a call to the start_assessment_endpoint with an unparsable token results in a 400 response."""
-        with patch("lti_consumer.plugin.views.JWT.unpack") as mock_jwt_unpack_method:
-            mock_jwt_unpack_method.side_effect = BadSyntax(value="", msg="")
+        with patch("lti_consumer.plugin.views.jwt.decode") as mock_jwt_decode_method:
+            mock_jwt_decode_method.side_effect = Exception
 
             response = self.client.post(
                 self.url,
diff --git a/lti_consumer/tests/unit/plugin/test_views.py b/lti_consumer/tests/unit/plugin/test_views.py
index 02baa3cb..cb6a889f 100644
--- a/lti_consumer/tests/unit/plugin/test_views.py
+++ b/lti_consumer/tests/unit/plugin/test_views.py
@@ -5,7 +5,7 @@
 from unittest.mock import patch, Mock
 
 import ddt
-
+import jwt
 from django.test.testcases import TestCase
 from django.urls import reverse
 from edx_django_utils.cache import TieredCache, get_cache_key
@@ -674,8 +674,11 @@ def setUp(self):
         )
         self.addCleanup(get_lti_consumer_patcher.stop)
         self._mock_xblock_handler = get_lti_consumer_patcher.start()
-        # Generate RSA
-        self.key = RSAKey(key=RSA.generate(2048), kid="1")
+        # Generate RSA and save exports
+        rsa_key = RSA.generate(2048).export_key('PEM')
+        algo_obj = jwt.get_algorithm_by_name('RS256')
+        self.key = algo_obj.prepare_key(rsa_key)
+        self.public_key = self.key.public_key()
 
     def get_body(self, token, **overrides):
         """
diff --git a/lti_consumer/tests/unit/test_lti_xblock.py b/lti_consumer/tests/unit/test_lti_xblock.py
index c088b012..7b71ae7d 100644
--- a/lti_consumer/tests/unit/test_lti_xblock.py
+++ b/lti_consumer/tests/unit/test_lti_xblock.py
@@ -2,6 +2,7 @@
 Unit tests for LtiConsumerXBlock
 """
 import json
+import jwt
 import logging
 import string
 from datetime import timedelta
@@ -1934,11 +1935,11 @@ def setUp(self):
         self.rsa_key_id = "1"
         # Generate RSA and save exports
         rsa_key = RSA.generate(2048)
-        self.key = RSAKey(
-            key=rsa_key,
-            kid=self.rsa_key_id
-        )
-        self.public_key = rsa_key.publickey().export_key()
+        pem = rsa_key.export_key('PEM')
+        algo_obj = jwt.get_algorithm_by_name('RS256')
+        self.key = algo_obj.prepare_key(pem)
+        self.public_key = rsa_key.public_key().export_key('PEM')
+
 
         self.xblock_attributes = {
             'lti_version': 'lti_1p3',
diff --git a/requirements/base.in b/requirements/base.in
index 119c77f4..6ab31f47 100644
--- a/requirements/base.in
+++ b/requirements/base.in
@@ -10,6 +10,7 @@ mako
 lazy
 XBlock
 xblock-utils
+pyjwt
 pycryptodomex
 pyjwkest
 edx-opaque-keys[django]
diff --git a/requirements/base.txt b/requirements/base.txt
index 45a4e0a1..375363e3 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -119,6 +119,8 @@ pycryptodomex==3.19.0
     #   pyjwkest
 pyjwkest==1.4.2
     # via -r requirements/base.in
+pyjwt==2.6.0
+    # via -r requirements/base.in
 pymongo==3.13.0
     # via edx-opaque-keys
 pynacl==1.5.0
diff --git a/requirements/ci.txt b/requirements/ci.txt
index 03f078b3..3f58eb64 100644
--- a/requirements/ci.txt
+++ b/requirements/ci.txt
@@ -317,6 +317,8 @@ pygments==2.16.1
     #   rich
 pyjwkest==1.4.2
     # via -r requirements/test.txt
+pyjwt==2.6.0
+    # via -r requirements/test.txt
 pylint==3.0.2
     # via
     #   -r requirements/test.txt
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 7c54cdaf..da6644dd 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -169,6 +169,8 @@ pycryptodomex==3.19.0
     #   pyjwkest
 pyjwkest==1.4.2
     # via -r requirements/base.txt
+pyjwt==2.6.0
+    # via -r requirements/base.txt
 pymongo==3.13.0
     # via
     #   -r requirements/base.txt
diff --git a/requirements/quality.txt b/requirements/quality.txt
index 3a3dcbc8..50608c83 100644
--- a/requirements/quality.txt
+++ b/requirements/quality.txt
@@ -210,6 +210,8 @@ pygments==2.16.1
     # via rich
 pyjwkest==1.4.2
     # via -r requirements/base.txt
+pyjwt==2.6.0
+    # via -r requirements/base.txt
 pylint==3.0.2
     # via
     #   -r requirements/quality.in
diff --git a/requirements/test.txt b/requirements/test.txt
index 02ab419b..403c2eb7 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -245,6 +245,8 @@ pygments==2.16.1
     #   rich
 pyjwkest==1.4.2
     # via -r requirements/base.txt
+pyjwt==2.6.0
+    # via -r requirements/base.txt
 pylint==3.0.2
     # via
     #   edx-lint