Jwt Decode
jwt_decodeRead-onlyIdempotent
Decode a JWT (JWS or JWE header), POST only (token in the JSON body, never in a URL): header, claims, alg/kid, exp/nbf/iat status with leeway, aud/iss checks, and security findings (alg none, HMAC alg-confusion risk, jku/x5u/jwk header keys, missing exp, odd kid). Optionally verifies the signature against a JWKS URL you supply, or one discovered from the token's https iss via OpenID discovery (fetched SSRF-safely): RS256/384/512, PS256/384/512, ES256/384/512, ES256K and EdDSA. Never trusts alg none. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/jwt-decode
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| aud | No | Expected audience to check | |
| iss | No | Expected issuer to check | |
| token | Yes | Compact JWT in the JSON body (a "Bearer " prefix is stripped). Alias: jwt | |
| leeway | No | Clock skew allowance in seconds, 0-600 (default 60) | |
| discover | No | Verify via OpenID discovery from the https iss claim when no jwks_url is given | |
| jwks_url | No | Optional JWKS (or single JWK) URL to verify the signature |