JWT signature and claims verification

$0.005 USDC per call · Developer and security · POST /api/v1/jwt-verify · Id jwt-verify

Verifies a JWS-compact JWT: signature over `base64url(header).base64url(payload)` with Web Crypto under the exact algorithm in the token's `alg` header (HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, EdDSA). Refuses 'none' unconditionally and rejects any alg not in the caller's allowedAlgorithms. Validates exp/nbf with a configurable clock-skew tolerance (default 60s), iss equality, and aud membership. Keys are supplied as a raw HMAC secret, a PEM SubjectPublicKeyInfo, or a JWK — no key fetching (no JWKS over the network).

What you get

A JWT library that trusts the token's own alg is the classic confused-deputy bug. This is the small reference that only trusts the caller's allow-list.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/jwt-verify. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/jwt-verify \
  -H 'content-type: application/json' \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzAwMDAwMDAwfQ.sig","key":{"kind":"hmac-secret","value":"your-256-bit-secret"},"allowedAlgorithms":["HS256"]}'

Input

Field	Type	Required	Description
`token`	string; length 0..16000	yes	The JWS-compact JWT: three base64url parts joined by '.'.
`key`	object	yes
`allowedAlgorithms`	array<string>; max 20 items	yes	Algorithms the caller accepts; verification fails if the header's alg is not here.
`issuer`	string; length 0..200	no	Require payload.iss to equal this.
`audience`	string; length 0..200	no	Require payload.aud to include this.
`toleranceSeconds`	integer	no	Clock-skew tolerance for exp/nbf. Default 60s.
`nowIso`	string; length 0..40	no	Override 'now' for deterministic tests.

Example request body

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzAwMDAwMDAwfQ.sig",
  "key": {
    "kind": "hmac-secret",
    "value": "your-256-bit-secret"
  },
  "allowedAlgorithms": [
    "HS256"
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`valid`	boolean	no
`header`	object	no
`payload`	object	no
`algorithm`	string	no
`expiresAt`	string	no
`notBefore`	string	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent