diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # ChangeLog
 
+## [0.6.0.0]
+### Added
+- Preserve the raw JWT in the tokens record returned by `validate` ([#43](https://github.com/krdlab/haskell-oidc-client/pull/43))
+
+### Fixed
+- s/JwtExceptoin/JwtException/ ([#45](https://github.com/krdlab/haskell-oidc-client/pull/45))
+- import data.monoid ([#46](https://github.com/krdlab/haskell-oidc-client/pull/46))
+- s/Incosistent/Inconsistent/ ([#49](https://github.com/krdlab/haskell-oidc-client/pull/49))
+- Use lenient decoding ([#50](https://github.com/krdlab/haskell-oidc-client/pull/50))
+
 ## [0.5.1.0]
 ### Fixed
 - fix: generate correct discovery url ([#39](https://github.com/krdlab/haskell-oidc-client/pull/39))
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # OpenID Connect 1.0 library for Relying Party
 
-[![Circle CI](https://circleci.com/gh/krdlab/haskell-oidc-client.svg?style=svg)](https://circleci.com/gh/krdlab/haskell-oidc-client)
+[![Testing](https://github.com/krdlab/haskell-oidc-client/workflows/Testing/badge.svg)](https://github.com/krdlab/haskell-oidc-client/actions?query=workflow%3ATesting)
 
 This package supports implementing of an OpenID Connect 1.0 Relying Party. It's written in Haskell.
 
diff --git a/oidc-client.cabal b/oidc-client.cabal
--- a/oidc-client.cabal
+++ b/oidc-client.cabal
@@ -1,5 +1,5 @@
 name:               oidc-client
-version:            0.5.1.0
+version:            0.6.0.0
 synopsis:           OpenID Connect 1.0 library for RP
 homepage:           https://github.com/krdlab/haskell-oidc-client
 stability:          experimental
diff --git a/src/Web/OIDC/Client/CodeFlow.hs b/src/Web/OIDC/Client/CodeFlow.hs
--- a/src/Web/OIDC/Client/CodeFlow.hs
+++ b/src/Web/OIDC/Client/CodeFlow.hs
@@ -26,7 +26,8 @@
 import           Data.Maybe                         (isNothing)
 import           Data.Monoid                        ((<>))
 import           Data.Text                          (Text, pack, unpack)
-import           Data.Text.Encoding                 (decodeUtf8)
+import           Data.Text.Encoding                 (decodeUtf8With)
+import           Data.Text.Encoding.Error           (lenientDecode)
 import           Data.Time.Clock.POSIX              (getPOSIXTime)
 import qualified Jose.Jwt                           as Jwt
 import           Network.HTTP.Client                (Manager, Request (..),
@@ -82,7 +83,7 @@
           result <- liftIO $ requestTokens oidc savedNonce code mgr
           sessionStoreDelete store
           return result
-      else throwM $ ValidationException $ "Incosistent state: " <> decodeUtf8 stateFromIdP
+      else throwM $ ValidationException $ "Inconsistent state: " <> decodeUtf8With lenientDecode stateFromIdP
 
 -- | Make URL for Authorization Request.
 {-# WARNING getAuthenticationRequestUrl "This function doesn't manage state and nonce. Use prepareAuthenticationRequestUrl only unless your IdP doesn't support state and/or nonce." #-}
@@ -150,7 +151,7 @@
     now <- getCurrentIntDate
     validateClaims
         (P.issuer . P.configuration . oidcProvider $ oidc)
-        (decodeUtf8 . oidcClientId $ oidc)
+        (decodeUtf8With lenientDecode . oidcClientId $ oidc)
         now
         savedNonce
         claims'
@@ -158,6 +159,7 @@
           accessToken  = I.accessToken tres
         , tokenType    = I.tokenType tres
         , idToken      = claims'
+        , idTokenJwt   = jwt'
         , expiresIn    = I.expiresIn tres
         , refreshToken = I.refreshToken tres
         }
diff --git a/src/Web/OIDC/Client/Discovery.hs b/src/Web/OIDC/Client/Discovery.hs
--- a/src/Web/OIDC/Client/Discovery.hs
+++ b/src/Web/OIDC/Client/Discovery.hs
@@ -22,6 +22,7 @@
 import           Control.Monad.Catch                (catch, throwM)
 import           Data.Aeson                         (eitherDecode)
 import           Data.ByteString                    (append, isSuffixOf)
+import           Data.Monoid                        ((<>))
 import           Data.Text                          (pack)
 import qualified Jose.Jwk                           as Jwk
 import           Network.HTTP.Client                (Manager, Request, httpLbs,
diff --git a/src/Web/OIDC/Client/IdTokenFlow.hs b/src/Web/OIDC/Client/IdTokenFlow.hs
--- a/src/Web/OIDC/Client/IdTokenFlow.hs
+++ b/src/Web/OIDC/Client/IdTokenFlow.hs
@@ -20,7 +20,8 @@
 import           Data.Maybe                         (isNothing, fromMaybe)
 import           Data.Monoid                        ((<>))
 import           Data.Text                          (unpack)
-import           Data.Text.Encoding                 (decodeUtf8)
+import           Data.Text.Encoding                 (decodeUtf8With)
+import           Data.Text.Encoding.Error           (lenientDecode)
 import qualified Jose.Jwt                           as Jwt
 import           Network.HTTP.Client                (getUri, setQueryString)
 import           Network.URI                        (URI)
@@ -72,7 +73,7 @@
                 $ throwIO
                 $ ValidationException "Nonce does not match request."
           pure idToken
-      else liftIO $ throwIO $ ValidationException $ "Incosistent state: " <> decodeUtf8 stateFromIdP
+      else liftIO $ throwIO $ ValidationException $ "Inconsistent state: " <> decodeUtf8With lenientDecode stateFromIdP
 
 -- | Make URL for Authorization Request.
 {-# WARNING getAuthenticationRequestUrl "This function doesn't manage state and nonce. Use prepareAuthenticationRequestUrl only unless your IdP doesn't support state and/or nonce." #-}
diff --git a/src/Web/OIDC/Client/Tokens.hs b/src/Web/OIDC/Client/Tokens.hs
--- a/src/Web/OIDC/Client/Tokens.hs
+++ b/src/Web/OIDC/Client/Tokens.hs
@@ -1,6 +1,6 @@
 {-# LANGUAGE DeriveGeneric     #-}
+{-# LANGUAGE LambdaCase        #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE LambdaCase #-}
 
 {-|
     Module: Web.OIDC.Client.Tokens
@@ -24,6 +24,7 @@
 import           Data.ByteString                    (ByteString)
 import qualified Data.ByteString.Lazy.Char8         as BL
 import           Data.Either                        (partitionEithers)
+import           Data.Monoid                        ((<>))
 import           Data.Text                          (Text, pack)
 import           Data.Text.Encoding                 (encodeUtf8)
 import           GHC.Generics                       (Generic)
@@ -38,6 +39,7 @@
     { accessToken  :: Text
     , tokenType    :: Text
     , idToken      :: IdTokenClaims a
+    , idTokenJwt   :: Jwt
     , expiresIn    :: Maybe Integer
     , refreshToken :: Maybe Text
     }
@@ -83,7 +85,7 @@
         Right (Unsecured payload) -> liftIO . throwIO $ UnsecuredJwt payload
         Right (Jws (_header, payload)) -> parsePayload payload
         Right (Jwe (_header, payload)) -> parsePayload payload
-        Left err -> liftIO . throwIO $ JwtExceptoin err
+        Left err -> liftIO . throwIO $ JwtException err
   where
     tryDecode jwks token = \case
         P.JwsAlgJson  alg -> liftIO $ Jwt.decode jwks (Just $ Jwt.JwsEncoding alg) token
diff --git a/src/Web/OIDC/Client/Types.hs b/src/Web/OIDC/Client/Types.hs
--- a/src/Web/OIDC/Client/Types.hs
+++ b/src/Web/OIDC/Client/Types.hs
@@ -53,7 +53,7 @@
     | InternalHttpException HttpException
     | JsonException Text
     | UnsecuredJwt ByteString
-    | JwtExceptoin JwtError
+    | JwtException JwtError
     | ValidationException Text
   deriving (Show, Typeable)
 
@@ -64,8 +64,8 @@
 data SessionStore m = SessionStore
     { sessionStoreGenerate :: m ByteString
     -- ^ Generate state and nonce at random
-    , sessionStoreSave :: State -> Nonce -> m ()
-    , sessionStoreGet :: m (Maybe State, Maybe Nonce)
-    , sessionStoreDelete :: m ()
+    , sessionStoreSave     :: State -> Nonce -> m ()
+    , sessionStoreGet      :: m (Maybe State, Maybe Nonce)
+    , sessionStoreDelete   :: m ()
     -- ^ Should delete at least nonce
     }