{"uid":"cap_ZhdSjfu6A-hcTyyUQ3UI_","slug":"bitbooth-jwt-verify-e716997f","name":"BitBooth JWT Verify","description":"BitBooth JWT Verify: pay 0.001 USDC, verify a JWT signature + canonical claims (iss / aud / exp / nbf) against an inline publicKey (PEM) or sharedSecret. Supports HS256/384/512 and RS256/384/512. Constant-time HMAC compare, configurable clock-skew tolerance, alg=none rejected. Stateless — caller supplies their key in the request body, BitBooth never stores it.","url":"https://app.heinrichstech.com/v1/cdp/jwt-verify","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["token"],"properties":{"token":{"type":"string"},"issuer":{"type":["string","array"]},"audience":{"type":["string","array"]},"publicKey":{"type":"string"},"sharedSecret":{"type":"string"},"clockToleranceSeconds":{"type":"number"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_aGQt7_0BdC7vaGhH5So3X","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a JWT signature and canonical claims (iss, aud, exp, nbf) against a caller-supplied public key or shared secret, supporting HS256/384/512 and RS256/384/512 algorithms","exampleAgentPrompt":"Can you verify this JWT for me — token is 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...', algorithm RS256, and here's the PEM public key; make sure the issuer is 'auth.myapp.com' and the audience is 'api.myapp.com'?","exampleUseCases":[{"title":"Auth middleware token verification","prompt":"I need to verify this incoming JWT before granting API access — token is 'eyJhbGci...', it uses RS256, here's the RSA public key in PEM format, expected issuer is 'https://accounts.myservice.com', and audience should be 'myapi'. Tell me if the signature and all claims are valid."},{"title":"Microservice HMAC token check","prompt":"Can you validate this service-to-service JWT that uses HS256? The token is 'eyJhbGci...', the shared secret is 'my-super-secret-key', expected issuer is 'internal-auth', and I want up to 30 seconds of clock skew tolerance."},{"title":"Debugging an expired or malformed token","prompt":"Something is wrong with this JWT — can you verify it and tell me exactly what's failing? Token is 'eyJhbGci...', algorithm is RS512, public key is this PEM. I want to know if it's the signature, expiration, or a bad issuer claim that's the problem."}],"resultDescription":"Returns a structured JSON response indicating whether the JWT signature is valid, whether each canonical claim (iss, aud, exp, nbf) passed or failed, the decoded payload, and any specific error messages for failed checks. The alg=none attack vector is always rejected.","failureModes":["Invalid or malformed JWT format returns a parse error","Signature mismatch returns verification failure with detail","Expired token (exp in past beyond clock skew) returns expiration error","Token not yet valid (nbf in future beyond clock skew) returns not-before error","Issuer or audience mismatch returns claim validation error","alg=none in token header is always rejected with a security error","Malformed PEM public key returns a key parsing error","Algorithm mismatch between token header and supplied algorithm returns an error","Payment failure (insufficient USDC) returns 402 before processing"],"whenToPreferThis":"Prefer this endpoint when you need stateless, server-side JWT verification without managing your own crypto infrastructure — especially valuable for AI agents that cannot safely bundle cryptographic libraries or need a trusted third-party check. Ideal for RS256/RS512 with PEM keys or HMAC secrets, with configurable clock-skew and strict claim validation. Unlike self-hosted solutions, this is pay-per-call with no key storage, making it suitable for ephemeral or serverless agent workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:46:17.949Z","isFirstParty":false}