Sign / mint a JWT
Signs a new JSON Web Token. Provide a payload of custom claims plus the key material for your chosen algorithm. The iat claim is set automatically and expiresIn controls exp.
- Symmetric algorithms (HS256/HS384/HS512) require a shared
secret. - Asymmetric algorithms (RS256/ES256/PS256) require a PEM PKCS8
privateKey.
Sign / mint a JWT › Request Body
Custom claims to embed. iat is set automatically.
algSigning algorithm.
secretShared secret. Required for HS* algorithms.
privateKeyPEM-encoded PKCS8 private key. Required for RS*/ES*/PS* algorithms. Newlines must be real \n escapes inside JSON.
Duration string (e.g. '2h', '30m', '7d') or a positive number of seconds-from-now. Takes precedence over any exp in payload.
issuerValue to set as the iss claim.
Value to set as the aud claim.
subjectValue to set as the sub claim.
Sign / mint a JWT › Responses
Signed token
tokenVerify a JWT signature and claims
Verifies a JWT's cryptographic signature and enforces the exp/nbf time claims plus any expected issuer and audience. A valid token returns valid: true with the decoded payload and header. A bad, expired, or claim-mismatched token returns HTTP 200 with valid: false plus an error and code.
Pass the algorithms array to pin accepted algorithms and defend against algorithm-confusion attacks.
Verify a JWT signature and claims › Request Body
tokensecretShared secret. Required for HS* algorithms.
publicKeyPEM-encoded SPKI public key. Required for RS*/ES*/PS* algorithms.
algorithmsRestrict accepted algorithms (defends against alg-confusion).
issuerExpected iss claim. Verification fails on mismatch.
Expected aud claim. Verification fails on mismatch.
Verify a JWT signature and claims › Responses
Verification result. valid:true with payload+header on success; valid:false with error+code on a bad/expired/claim-mismatched token.
Decision Table
| Variant | Matching Criteria |
|---|---|
| type = object · requires: valid | |
| type = object · requires: valid, error |
Decode a JWT WITHOUT verifying
Decodes a compact JWS and returns its unverified header and payload along with a warning. This endpoint does NOT check the signature — never trust the returned data for authorization. Use /v1/verify to validate a token.
query Parameters
tokenThe compact JWS to inspect.
Decode a JWT WITHOUT verifying › Responses
Decoded (unverified) header and payload
warningsignature_present