Validate token sent to bring your own function within function app itself.

Hi,
I'm trying to use a bring your own function with an existing function app that cannot be set to require authentication as default.
I've changed the provider (Azure static web apps(linked)) to allow unauthenticated requests to allow the existing functions to work.
When quizzing the api, the function gets a token which is ripe for validation. The only problem is I simply cannot locate the kid.

Example token received

{
"alg": "RS256",
"kid": "oOxnukAHRuDzFwkfhXgsLP7ONGI",
"typ": "JWT"
}
{
"prn": "",
"sub": "",
"iss": "https://random-name.azurestaticapps.net/.auth",
"aud": "https://mylinkedfunction.azurewebsites.net",
"nbf": 1629974700,
"exp": 1629975000,
"iat": 1629974700
}

I've looked everywhere I can think of.

https://login.microsoftonline.com/common/discovery/keys
https://login.microsoftonline.com/common/discovery/V2.0/keys
https://login.microsoftonline.com/Mytenant/discovery/keys
https://login.microsoftonline.com/Mytenant/discovery/V2.0/keys

Am I trying to something which is not supported? The documentation on bring you own functions under security constraints, authentication and authorization suggests changing the security to allow unauthenticated access as an option which fits my scenario. I am assuming you could then validate within the function itself.

Many thanks