{"uid":"cap_xLwbab0dRhaBX2rdek9cO","slug":"swift-bot-labs-jwt-decode-verify-362ee3e0","name":"Swift Bot Labs JWT Decode & Verify","description":"62 small, deterministic utility APIs (DNS and e-mail checks, web extraction, EVM decoding, x402 checks, IP math, JSON/CSV, hashing, conversions). No account or API key: pay per call in USDC with x402.","url":"https://x402-toolbox.swiftbotlab.workers.dev/v1/jwt/decode?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"token":{"type":"string","maxLength":16384},"secret":{"type":"string","maxLength":4096,"description":"Optional HMAC secret to verify the signature"},"secretEncoding":{"enum":["utf8","base64","hex"],"type":"string","default":"utf8"}}},"responseSchema":{"type":"json","example":{"ok":true,"tool":"jwt-decode","result":{"times":{"iat":"2018-01-18T01:30:22.000Z"},"header":{"alg":"HS256","typ":"JWT"},"expired":false,"payload":{"iat":1516239022,"sub":"1234567890","name":"John Doe"},"signatureVerified":true}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5HNGr0_UZ-w5tj7HKk--n","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Decodes a JWT token into its header, payload, and timestamp fields, and optionally verifies its HMAC signature against a provided secret.","exampleAgentPrompt":"Decode this JWT for me and verify its signature using the secret 'mysecret' (UTF-8): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c — show me the header, payload, expiry status, and whether the signature is valid.","exampleUseCases":[{"title":"Inspect auth token from login flow","prompt":"I've got this JWT from our auth server and I want to see what's inside it — header, payload, and whether it's expired: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsImV4cCI6MTcwMDAwMDAwMH0.abc123"},{"title":"Verify webhook JWT signature","prompt":"Can you verify this JWT token's signature using the HMAC secret 'wh_secret_abc' (UTF-8)? The token is eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJldmVudCI6InBheW1lbnQiLCJhbW91bnQiOjEwMH0.xyz789 — I need to confirm it wasn't tampered with before processing the webhook."},{"title":"Debug JWT with base64-encoded secret","prompt":"Decode this JWT and check the signature using my base64-encoded secret 'c2VjcmV0a2V5MTIz': eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiI0MiIsInJvbGUiOiJhZG1pbiJ9.def456 — I want to see the full payload and know if the sig checks out."}],"resultDescription":"A JSON object with ok=true and a result containing: the decoded header (algorithm, type), decoded payload (all claims), issued-at and other timestamps formatted as ISO 8601 strings, an expired boolean, and a signatureVerified boolean if a secret was provided.","failureModes":["Malformed JWT string (not three dot-separated base64 parts) returns an error","Wrong or mismatched secret causes signatureVerified: false rather than an error","Incorrect secretEncoding (e.g. passing raw bytes as utf8) yields failed verification","Payment failure via x402 if USDC balance is insufficient","Token exceeds 16384 character limit","Missing required token field returns validation error"],"whenToPreferThis":"Use this endpoint when you need a quick, serverless JWT decode or HMAC signature check without importing a JWT library or spinning up infrastructure. Ideal for AI agents operating in sandboxed environments, scripts needing one-off token inspection, or workflows that need to verify HS256 tokens on demand. Pay-per-call with no account setup makes it convenient for low-volume or ad-hoc use cases.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:02.000Z","isFirstParty":false,"canonicalSlug":"swift-bot-labs-jwt-decode-verify-362ee3e0"}