{"uid":"cap_o7SMXEGROjdxU3Z-tMPb9","slug":"sicher-jwt-verify-c61bb30a","name":"Sicher JWT Verify","description":"Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key.","url":"https://sicher.halowerk.com/v1/jwt-verify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"token":{"type":"string","maxLength":20000,"minLength":10,"description":"The JWT in compact form."},"secret":{"type":"string","maxLength":2000,"description":"Shared secret for HS256/384/512."},"jwks_url":{"type":"string","maxLength":2000,"description":"JWKS endpoint; the key is picked by kid."},"public_key_pem":{"type":"string","maxLength":8000,"description":"PEM public key for RS/PS/ES algorithms."},"expected_issuer":{"type":"string","maxLength":500,"description":"Issuer the token must carry."},"expected_audience":{"type":"string","maxLength":500,"description":"Audience the token must name."},"clock_skew_seconds":{"type":"integer","default":60,"maximum":3600,"minimum":0,"description":"Tolerance for exp and nbf."},"max_lifetime_seconds":{"type":"integer","minimum":1,"description":"Flag tokens valid for longer than this."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pNghv1ZZIMtnBAs9JKbS8","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a JWT's structure, claims (expiry, nbf, iat, issuer, audience, lifetime), and cryptographic signature (HMAC, RSA, RSA-PSS, ECDSA) against a shared secret, PEM key, or JWKS endpoint.","exampleAgentPrompt":"Check whether this JWT is valid — verify the signature using our JWKS at https://auth.example.com/.well-known/jwks.json, expect issuer 'https://auth.example.com' and audience 'my-api', and allow up to 30 seconds of clock skew.","exampleUseCases":[{"title":"API gateway token guard","prompt":"Before letting this request through, verify the bearer JWT — check its signature against our JWKS at https://auth.mycompany.com/.well-known/jwks.json, confirm the issuer is 'https://auth.mycompany.com' and audience is 'internal-api', and reject it if it's expired or used before its not-before time."},{"title":"Microservice-to-microservice auth check","prompt":"Validate this service-to-service JWT signed with our HMAC secret 'sup3rs3cret', make sure the issuer is 'order-service' and the audience is 'inventory-service', and flag it if the token lifetime exceeds 1 hour."},{"title":"Third-party OIDC token validation","prompt":"I've got an ID token from our identity provider — can you verify it using the RSA public key in this PEM, confirm the issuer is 'https://login.example.com', audience is 'client-abc', and allow a 60-second clock skew?"}],"resultDescription":"Returns a structured result indicating whether the JWT passed or failed validation, which specific checks succeeded or failed (signature, expiry, nbf, iat, issuer, audience, lifetime), the decoded payload claims, and details about which key (kid) was matched if a JWKS was used.","failureModes":["Expired token: validation fails with expiry check error","Signature mismatch: fails if secret or key does not match","JWKS fetch failure: unreachable or malformed JWKS URL causes error","kid not found: token's key ID missing from provided JWKS","Issuer/audience mismatch: claims don't match expected values","Malformed JWT: unparseable token structure returns parse error","nbf in the future: token not yet valid, fails not-before check"],"whenToPreferThis":"Choose this endpoint when you need server-side, authoritative JWT verification with multi-layer checks (structure + claims + cryptographic signature) and need to support multiple algorithm families (HMAC, RSA, RSA-PSS, ECDSA) and key sources (shared secret, PEM, JWKS). Ideal for agentic pipelines where the agent must authenticate inbound requests or validate identity tokens before taking action, without implementing crypto logic itself.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T00:47:21.090Z","isFirstParty":false,"canonicalSlug":"sicher-jwt-verify-c61bb30a"}