# JWT Decode & Security Flag Checker

> JWT Decode & Security Flag Checker is a paid API for AI agents from dev-utils.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-11-02).

Decodes a JWT's header and payload without verifying the signature, and flags security issues like alg:none, expiry, not-before violations, and missing claims.

## Facts

- Endpoint: GET https://dev-utils.x402tookit.com/jwt-decode?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/jwt-decode-security-flag-checker-94c9f949
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JCyEy8nnfP4WzGFsH2M_3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability jwt-decode-security-flag-checker-94c9f949
```

Example prompt: Can you decode this JWT for me and tell me if it's expired, uses a dangerous algorithm like alg:none, or is missing any important claims? The token is eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiaXNzIjoibXlhcHAiLCJleHAiOjE2MDAwMDAwMDB9.signature

## When to prefer this

Use this endpoint when you need to quickly inspect a JWT's contents and catch common security misconfigurations (alg:none, expiry, nbf, missing claims) without having access to the signing secret or public key. It is ideal for debugging, auditing, or pipeline validation steps where signature verification is handled separately or is not required.

## Known failure modes

- Malformed JWT (not three dot-separated parts) returns an error
- Token with non-base64url encoding fails to decode
- Invalid ISO timestamp in 'now' parameter causes a parse error
- Empty or missing token query parameter returns a 400-style error

## How this service works

Decode a JWT header and payload (no signature check) and flag alg none, expiry, nbf and missing claims.

## Output

Returns the decoded JWT header and payload as JSON objects, the algorithm used, expiry status and seconds remaining, a judgedAt timestamp, a verdict string, a human-readable summary, an array of security flags (each with code, severity, and message), lists of missing or unchecked claims, and a disclaimer noting that the signature is not verified.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "token"
     ],
     "properties": {
      "now": {
       "type": "string",
       "description": "ISO time to judge exp/nbf against, default now"
      },
      "token": {
       "type": "string",
       "description": "The JWT (three dot-separated parts). Use an expired or test token, never a live secret"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "alg": {
       "type": [
        "null",
        "string"
       ]
      },
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "flags": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "object",
        "properties": {
         "code": {
          "type": [
           "null",
           "string"
          ]
         },
         "message": {
          "type": [
           "null",
           "string"
          ]
         },
         "severity": {
          "type": [
           "null",
           "string"
          ]
         }
        }
       }
      },
      "header": {
       "type": [
        "null",
        "object"
       ],
       "properties": {
        "alg": {
         "type": [
          "null",
          "string"
         ]
        },
        "typ": {
         "type": [
          "null",
          "string"
         ]
        }
       }
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "expired": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "payload": {
       "type": [
        "null",
        "object"
       ],
       "properties": {
        "exp": {
         "type": [
          "null",
          "number"
         ]
        },
        "iss": {
         "type": [
          "null",
          "string"
         ]
        },
        "http://example.com/is_root": {
         "type": [
       
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/jwt-decode-security-flag-checker-94c9f949/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from dev-utils.x402tookit.com](https://www.zero.xyz/host/dev-utils.x402tookit.com/llms.txt)