A token has a valid signature and has not expired. Which check still prevents use at the …

A token has a valid signature and has not expired. Which check still prevents use at the wrong API?

1. Require the current API in the aud claim.
2. Decode the payload a second time.
3. Accept any token from the same browser.