{"uid":"cap_7RWh2K1e8qby967dzfQfN","slug":"moneytools-jwt-inspector-jwks-verifier-7563e954","name":"MoneyTools JWT Inspector & JWKS Verifier","description":"JWT inspector + JWKS verify: Decode a JWT, explain its claims (expired? lifetime?) and verify RS/PS/ES/EdDSA signatures against a public JWKS URL or the issuer's OIDC discovery. No secrets needed or stored. Free tier 10/day; then $0.002 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.002 USDC per call via x402 on Base. Run by MoneyTools.","url":"https://tools.moneytools.dev/v1/jwt?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"token":{"type":"string","examples":["eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwiZXhwIjoxfQ.x"],"description":"JWT"},"jwksUrl":{"type":"string","description":"JWKS URL"},"discover":{"type":"boolean","examples":["false"],"description":"true = use iss OIDC discovery"}}},"responseSchema":{"type":"json"},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-cx0PgOPD63zbWa3-Glgv","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT, explains its claims and expiry, and cryptographically verifies RS/PS/ES/EdDSA signatures against a provided JWKS URL or the issuer's OIDC discovery endpoint","exampleAgentPrompt":"Can you decode this JWT and verify its signature using the JWKS endpoint at https://example.auth0.com/.well-known/jwks.json — tell me if it's expired and explain its claims: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNzAwMDAwMDAwfQ.abc123","exampleUseCases":[{"title":"Debug expired auth token in production","prompt":"This JWT from our production API is being rejected — can you decode it and tell me if it's expired, what the claims say, and verify its signature against our JWKS at https://api.myapp.com/.well-known/jwks.json? Token: eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyNDU2IiwiZXhwIjoxNjAwMDAwMDAwfQ.sig"},{"title":"Verify OIDC token via issuer discovery","prompt":"I have an ID token from Google — can you verify its signature using OIDC discovery (set discover to true) and explain all the claims? The token is eyJhbGciOiJSUzI1NiIsImtpZCI6ImtleUlkIn0.eyJzdWIiOiIxMjM0NTYiLCJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJleHAiOjIwMDAwMDAwMDB9.sighere"},{"title":"Audit service-to-service JWT claims","prompt":"Our microservice is receiving this JWT from an internal service — decode it and tell me the subject, audience, issued-at time, expiry, and whether the ES256 signature is valid against this JWKS URL: https://internal-auth.mycompany.com/jwks.json. Token: eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJzZXJ2aWNlQSIsImF1ZCI6InNlcnZpY2VCIn0.sig"}],"resultDescription":"Returns the decoded JWT header and payload with human-readable explanations of each claim (e.g. expiry status, lifetime, subject, audience), plus a cryptographic signature verification result indicating whether the token is valid against the provided JWKS URL or OIDC-discovered public keys. No private keys or secrets are required or stored.","failureModes":["Invalid JWT format — token cannot be parsed (malformed base64 or missing segments)","JWKS URL unreachable or returns non-200 response","No matching key ID (kid) found in the JWKS for this token","Unsupported algorithm (e.g. HS256 symmetric — requires a secret, not supported)","OIDC discovery failed — issuer URL does not expose /.well-known/openid-configuration","Token is valid but signature verification fails (tampered payload)","Rate limit exceeded on free tier (10/day) without payment credentials"],"whenToPreferThis":"Use this endpoint when you need to decode and cryptographically verify a JWT with an asymmetric signature (RS256, PS256, ES256, EdDSA) without handling private keys or secrets. It's ideal for debugging auth failures, auditing third-party tokens, or validating OIDC identity tokens from providers like Google, Auth0, or Azure AD. Prefer this over manual JWKS fetching when you want claim explanations and expiry analysis in one call. Not suitable for HS256/symmetric tokens (which require the shared secret).","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-05T12:40:12.818Z","isFirstParty":false,"canonicalSlug":"moneytools-jwt-inspector-jwks-verifier-7563e954"}