{"id":"jwt-verify","title":"JWT signature and claims verification","description":"Verifies a JWS-compact JWT: signature over `base64url(header).base64url(payload)` with Web Crypto under the exact algorithm in the token's `alg` header (HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, EdDSA). Refuses 'none' unconditionally and rejects any alg not in the caller's allowedAlgorithms. Validates exp/nbf with a configurable clock-skew tolerance (default 60s), iss equality, and aud membership. Keys are supplied as a raw HMAC secret, a PEM SubjectPublicKeyInfo, or a JWK — no key fetching (no JWKS over the network).","roi":"A JWT library that trusts the token's own alg is the classic confused-deputy bug. This is the small reference that only trusts the caller's allow-list.","audience":"developer","package":"code-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/jwt-verify","path":"/api/v1/jwt-verify","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["token","key","allowedAlgorithms"],"properties":{"token":{"type":"string","maxLength":16000,"description":"The JWS-compact JWT: three base64url parts joined by '.'."},"key":{"type":"object","required":["kind","value"],"properties":{"kind":{"type":"string","enum":["hmac-secret","pem-spki","jwk"]},"value":{"description":"The key material: a string for hmac-secret and pem-spki, a JWK object for jwk."}}},"allowedAlgorithms":{"type":"array","items":{"type":"string"},"minItems":1,"maxItems":20,"description":"Algorithms the caller accepts; verification fails if the header's alg is not here."},"issuer":{"type":"string","maxLength":200,"description":"Require payload.iss to equal this."},"audience":{"type":"string","maxLength":200,"description":"Require payload.aud to include this."},"toleranceSeconds":{"type":"integer","description":"Clock-skew tolerance for exp/nbf. Default 60s."},"nowIso":{"type":"string","maxLength":40,"description":"Override 'now' for deterministic tests."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"header":{"type":"object"},"payload":{"type":"object"},"algorithm":{"type":"string"},"expiresAt":{"type":"string"},"notBefore":{"type":"string"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"header":{"type":"object"},"payload":{"type":"object"},"algorithm":{"type":"string"},"expiresAt":{"type":"string"},"notBefore":{"type":"string"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzAwMDAwMDAwfQ.sig","key":{"kind":"hmac-secret","value":"your-256-bit-secret"},"allowedAlgorithms":["HS256"]},"openapiOperation":{"operationId":"jwt_verify","summary":"JWT signature and claims verification","description":"Verifies a JWS-compact JWT: signature over `base64url(header).base64url(payload)` with Web Crypto under the exact algorithm in the token's `alg` header (HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, EdDSA). Refuses 'none' unconditionally and rejects any alg not in the caller's allowedAlgorithms. Validates exp/nbf with a configurable clock-skew tolerance (default 60s), iss equality, and aud membership. Keys are supplied as a raw HMAC secret, a PEM SubjectPublicKeyInfo, or a JWK — no key fetching (no JWKS over the network).\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/jwt-verify","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["token","key","allowedAlgorithms"],"properties":{"token":{"type":"string","maxLength":16000,"description":"The JWS-compact JWT: three base64url parts joined by '.'."},"key":{"type":"object","required":["kind","value"],"properties":{"kind":{"type":"string","enum":["hmac-secret","pem-spki","jwk"]},"value":{"description":"The key material: a string for hmac-secret and pem-spki, a JWK object for jwk."}}},"allowedAlgorithms":{"type":"array","items":{"type":"string"},"minItems":1,"maxItems":20,"description":"Algorithms the caller accepts; verification fails if the header's alg is not here."},"issuer":{"type":"string","maxLength":200,"description":"Require payload.iss to equal this."},"audience":{"type":"string","maxLength":200,"description":"Require payload.aud to include this."},"toleranceSeconds":{"type":"integer","description":"Clock-skew tolerance for exp/nbf. Default 60s."},"nowIso":{"type":"string","maxLength":40,"description":"Override 'now' for deterministic tests."}}},"example":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzAwMDAwMDAwfQ.sig","key":{"kind":"hmac-secret","value":"your-256-bit-secret"},"allowedAlgorithms":["HS256"]}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"valid":{"type":"boolean"},"header":{"type":"object"},"payload":{"type":"object"},"algorithm":{"type":"string"},"expiresAt":{"type":"string"},"notBefore":{"type":"string"},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/jwt-verify/","docsJson":"https://agents.writerslogic.com/docs/jwt-verify.json","sample":"https://agents.writerslogic.com/api/v1/samples/jwt-verify","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}