{"uid":"cap_EW65XJsSnzWLQKdRkmBsa","slug":"jwt-toolkit-verify-6cf17cf3","name":"JWT Toolkit – Verify","description":"Verify a JSON Web Token's signature and claims against a shared secret (HS*) or a PEM public key (RS/ES/PS). Returns { valid, payload } on success or { valid: false, reason } for a bad signature, expired/not-yet-active token, or a failed issuer/audience/subject check. Pass `algorithms` to pin the accepted signing algorithms and prevent algorithm-confusion attacks.","url":"https://jwt.openverbs.com/v1/verify","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["token","key"],"properties":{"key":{"type":"string","maxLength":16384,"minLength":1,"description":"The HMAC shared secret (HS*) or the PEM-encoded public key (RS/ES/PS)."},"token":{"type":"string","maxLength":32768,"minLength":1,"description":"The compact JWT to verify."},"issuer":{"type":"string","description":"Required `iss` claim value."},"subject":{"type":"string","description":"Required `sub` claim value."},"audience":{"type":"string","description":"Required `aud` claim value."},"algorithms":{"type":"array","items":{"enum":["HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512","PS256","PS384","PS512"],"type":"string"},"minItems":1,"description":"Accepted signing algorithms (subset of HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512). Strongly recommended."},"ignoreExpiration":{"type":"boolean","description":"Do not treat an expired token as invalid."},"clockToleranceSec":{"type":"integer","maximum":86400,"minimum":0,"description":"Clock skew tolerance in seconds."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Ry7fP2spc7pnZi2LIAnXJ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a compact JWT token's signature, expiration, and claims against a provided key","exampleAgentPrompt":"Verify this JWT for me — token is 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...', the HMAC secret is 'mysecretkey', only allow HS256, and require the issuer to be 'auth.myapp.com'.","exampleUseCases":[{"title":"Validate incoming API bearer token","prompt":"Check whether this JWT bearer token is valid before I let it through: token is 'eyJhbGciOiJSUzI1NiJ9...', use this PEM public key, only allow RS256, and require the audience to be 'api.myservice.com'."},{"title":"Confirm user session token on login","prompt":"Verify the user's session JWT — token is 'eyJhbGciOiJIUzUxMiJ9...', shared secret is 's3cr3t!', accept HS512 only, and make sure the subject matches 'user_12345'."},{"title":"Audit expired token with clock tolerance","prompt":"I need to verify an older JWT that might be slightly expired — token is 'eyJhbGciOiJFUzI1NiJ9...', use this PEM EC public key, allow ES256, and give it up to 30 seconds of clock skew tolerance."}],"resultDescription":"The endpoint returns a verification result indicating whether the JWT is valid, along with the decoded payload claims (such as sub, iss, aud, exp, iat) if verification succeeds, or a structured error message describing the failure reason (invalid signature, expired token, claim mismatch, unsupported algorithm, etc.).","failureModes":["Invalid or tampered token signature returns a verification failure response","Expired token without ignoreExpiration flag causes validation to fail","Algorithm not in the allowed list triggers an algorithm mismatch error","Issuer, subject, or audience claim mismatch returns a claim validation error","Malformed JWT (not three base64url segments) returns a parse error","Incorrect or mismatched key type (e.g. HMAC secret used for RS256 token) causes signature failure","Missing required fields (token or key) returns a 400-level error"],"whenToPreferThis":"Use this endpoint when you need a lightweight, pay-per-call JWT verification service without managing your own cryptography libraries or authentication infrastructure. It is particularly useful in agent workflows that need to validate incoming tokens from users or downstream services before proceeding, or in serverless/edge contexts where installing JWT libraries is inconvenient. Supports the full range of HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), and EC (ES256/384/512) algorithms, making it versatile across auth systems.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T18:41:19.685Z","isFirstParty":false}