{"uid":"cap_QeaVgyLkx9MUqAgap9xJC","slug":"jwt-hmac-signature-verifier-24749fd7","name":"JWT HMAC Signature Verifier","description":"Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)","url":"https://agent402.tools/api/jwt-verify","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"token":{"type":"string"},"secret":{"type":"string"}}},"responseSchema":{"type":"json","example":{"valid":true,"expired":false,"payload":{"sub":"agent402"},"algorithm":"HS256"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lzyhPzJtYAwiacoS1AWBV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies an HS256, HS384, or HS512 JWT signature against a shared secret and checks token expiry, returning validity status and the decoded payload.","exampleAgentPrompt":"Can you verify this JWT token for me — 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U' — using the secret 'mySuperSecretKey123' and tell me if it's valid and what the payload says?","exampleUseCases":null,"resultDescription":"Returns a boolean validity flag indicating whether the HMAC signature is correct and the token is not expired, along with the fully decoded JWT payload (header + claims) if valid.","failureModes":["Invalid or malformed JWT format — token cannot be parsed","Wrong secret provided — signature verification fails, valid=false returned","Expired token — expiry check fails even if signature is correct","Unsupported algorithm (e.g. RS256, ES256) — HMAC-only endpoint rejects non-HMAC tokens","Missing required fields (token or secret) — request rejected with validation error","Network timeout or service unavailability"],"whenToPreferThis":"Use this endpoint when you need to verify HMAC-signed JWTs (HS256, HS384, or HS512) server-side without running your own cryptographic library. Ideal for agents that receive tokens from users or upstream services and need to confirm authenticity and freshness before trusting the embedded claims. Not suitable for asymmetric JWT algorithms like RS256 or ES256.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T19:14:02.943Z","isFirstParty":false}