# BitBooth JWT Verify

> BitBooth JWT Verify is a paid API for AI agents from app.heinrichstech.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Verifies a JWT signature and canonical claims (iss, aud, exp, nbf) against a caller-supplied public key or shared secret, supporting HS256/384/512 and RS256/384/512 algorithms

## Facts

- Endpoint: POST https://app.heinrichstech.com/v1/cdp/jwt-verify
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bitbooth-jwt-verify-e716997f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZhdSjfu6A-hcTyyUQ3UI_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bitbooth-jwt-verify-e716997f -d '<json body>'
```

Example prompt: Can you verify this JWT for me — token is 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...', algorithm RS256, and here's the PEM public key; make sure the issuer is 'auth.myapp.com' and the audience is 'api.myapp.com'?

## When to prefer this

Prefer this endpoint when you need stateless, server-side JWT verification without managing your own crypto infrastructure — especially valuable for AI agents that cannot safely bundle cryptographic libraries or need a trusted third-party check. Ideal for RS256/RS512 with PEM keys or HMAC secrets, with configurable clock-skew and strict claim validation. Unlike self-hosted solutions, this is pay-per-call with no key storage, making it suitable for ephemeral or serverless agent workflows.

## Known failure modes

- Invalid or malformed JWT format returns a parse error
- Signature mismatch returns verification failure with detail
- Expired token (exp in past beyond clock skew) returns expiration error
- Token not yet valid (nbf in future beyond clock skew) returns not-before error
- Issuer or audience mismatch returns claim validation error
- alg=none in token header is always rejected with a security error
- Malformed PEM public key returns a key parsing error
- Algorithm mismatch between token header and supplied algorithm returns an error
- Payment failure (insufficient USDC) returns 402 before processing

## How this service works

BitBooth JWT Verify: pay 0.001 USDC, verify a JWT signature + canonical claims (iss / aud / exp / nbf) against an inline publicKey (PEM) or sharedSecret. Supports HS256/384/512 and RS256/384/512. Constant-time HMAC compare, configurable clock-skew tolerance, alg=none rejected. Stateless — caller supplies their key in the request body, BitBooth never stores it.

## Output

Returns a structured JSON response indicating whether the JWT signature is valid, whether each canonical claim (iss, aud, exp, nbf) passed or failed, the decoded payload, and any specific error messages for failed checks. The alg=none attack vector is always rejected.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "token"
     ],
     "properties": {
      "token": {
       "type": "string"
      },
      "issuer": {
       "type": [
        "string",
        "array"
       ]
      },
      "audience": {
       "type": [
        "string",
        "array"
       ]
      },
      "publicKey": {
       "type": "string"
      },
      "sharedSecret": {
       "type": "string"
      },
      "clockToleranceSeconds": {
       "type": "number"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bitbooth-jwt-verify-e716997f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from app.heinrichstech.com](https://www.zero.xyz/host/app.heinrichstech.com/llms.txt)