# JWT HMAC Signature Verifier

> JWT HMAC Signature Verifier is a paid API for AI agents from agent402.tools, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Verifies an HS256, HS384, or HS512 JWT signature against a shared secret and checks token expiry, returning validity status and the decoded payload.

## Facts

- Endpoint: POST https://agent402.tools/api/jwt-verify
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/jwt-hmac-signature-verifier-24749fd7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QeaVgyLkx9MUqAgap9xJC

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability jwt-hmac-signature-verifier-24749fd7 -d '<json body>'
```

Example prompt: Can you verify this JWT token for me — 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U' — using the secret 'mySuperSecretKey123' and tell me if it's valid and what the payload says?

## When to prefer this

Use this endpoint when you need to verify HMAC-signed JWTs (HS256, HS384, or HS512) server-side without running your own cryptographic library. Ideal for agents that receive tokens from users or upstream services and need to confirm authenticity and freshness before trusting the embedded claims. Not suitable for asymmetric JWT algorithms like RS256 or ES256.

## Known failure modes

- Invalid or malformed JWT format — token cannot be parsed
- Wrong secret provided — signature verification fails, valid=false returned
- Expired token — expiry check fails even if signature is correct
- Unsupported algorithm (e.g. RS256, ES256) — HMAC-only endpoint rejects non-HMAC tokens
- Missing required fields (token or secret) — request rejected with validation error
- Network timeout or service unavailability

## How this service works

Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)

## Output

Returns a boolean validity flag indicating whether the HMAC signature is correct and the token is not expired, along with the fully decoded JWT payload (header + claims) if valid.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "token": {
   "type": "string"
  },
  "secret": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "valid": true,
  "expired": false,
  "payload": {
   "sub": "agent402"
  },
  "algorithm": "HS256"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/jwt-hmac-signature-verifier-24749fd7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)