{"uid":"cap_UuYsqsQTFpyS2HtpO0G2G","slug":"pennyrail-jwt-verify-hmac-a26e7c70","name":"PennyRail JWT Verify HMAC","description":"Machine-readable settlement service","url":"https://pennyrail.vercel.app/api/p/skill/jwt.toolkit--jwt-verify-hmac","method":"POST","headers":{},"bodySchema":{"type":"object","required":["input"],"properties":{"input":{"type":"object"}}},"responseSchema":{"type":"object","additionalProperties":true},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_iaRYz49AAVMLtMXAc_jKh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a JWT token using HMAC signature validation and returns the verification result","exampleAgentPrompt":"Can you verify this JWT token for me using HMAC — the token is eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiIxMjMifQ.abc123 and the secret is 'mysecretkey'?","exampleUseCases":[{"title":"API gateway token validation","prompt":"I need to verify the JWT coming in from my API gateway — the token is eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQ1NiJ9.xyz789 and we sign with HMAC using the secret 'prod-secret-2024'. Can you check if it's valid?"},{"title":"User session authentication check","prompt":"A user just sent me their session token eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MDAwMDAwMDB9.def456 — can you verify it against our HMAC secret 'session-key-abc' and tell me if their session is still valid?"},{"title":"Webhook signature verification","prompt":"I received a webhook payload with this JWT eyJhbGciOiJIUzI1NiJ9.eyJldmVudCI6InBheW1lbnQifQ.ghi789 — verify it using HMAC with secret 'webhook-secret-xyz' so I know it actually came from the right source."}],"resultDescription":"Returns a JSON object indicating whether the JWT signature is valid, along with the decoded token payload and any relevant claims if verification succeeds, or an error/failure indicator if the token is invalid, expired, or tampered with.","failureModes":["Invalid or malformed JWT token — returns error indicating bad token format","Wrong HMAC secret provided — signature mismatch error","Expired JWT — verification fails with expiry error","Unsupported algorithm specified — returns unsupported algorithm error","Missing required input fields — returns validation error","Payment failure or insufficient USDC balance — 402 payment required error"],"whenToPreferThis":"Use this endpoint when you need a lightweight, pay-per-call HMAC JWT verification without standing up your own auth infrastructure. Particularly useful for agents that need one-off or low-volume JWT validation without managing a full identity service. Best for HS256/HS384/HS512 HMAC-signed tokens where you hold the shared secret.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T18:56:20.359Z","isFirstParty":false}