public function validateAndDecodeSignedRequest($encoded_signature, $payload, $algorithm = 'HMAC-SHA256') {
        $sig = self::base64UrlDecode($encoded_signature);

        switch ($algorithm) {
            case 'HMAC-SHA256' :
                $expected_sig = hash_hmac('sha256', $payload, $this->getClientSignSecret(), true);

                // check sig
                if (!hash_equals($sig, $expected_sig)) {
                    self::errorLog('Bad Signed JSON signature!');
                    return null;
                }

                return json_decode(self::base64UrlDecode($payload), true);
                break;
            default:
                self::errorLog('Unknown algorithm. Expected HMAC-SHA256');
                break;
        }
        return null;
    }