# JWT Toolkit – Sign

> JWT Toolkit – Sign is a paid API for AI agents from jwt.openverbs.com, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-14).

Signs a JSON payload as a JWT using a specified algorithm and key, returning a signed token with configurable claims.

## Facts

- Endpoint: POST https://jwt.openverbs.com/v1/sign
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/jwt-toolkit-sign-e0860182
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_t4U2Ka_j2WtEgjcMhIeTn

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability jwt-toolkit-sign-e0860182 -d '<json body>'
```

Example prompt: Sign a JWT using HS256 with the secret key 'my-super-secret-key', set the issuer to 'myapp.com', subject to 'user-42', audience to 'api.myapp.com', and make it expire in 3600 seconds.

## When to prefer this

Choose this endpoint when you need to programmatically sign JWTs server-side without managing a local crypto library, or when running in an agent/serverless context where importing jsonwebtoken or similar is inconvenient. It supports the full suite of HMAC, RSA, ECDSA, and RSASSA-PSS algorithms. Prefer this over a full auth server when you only need token minting, not a complete identity management solution.

## Known failure modes

- Invalid or mismatched key for the chosen algorithm (e.g. passing an HMAC secret for RS256) returns a signing error
- Malformed PEM-encoded key returns a key parsing error
- Missing required fields (payload, key, algorithm) returns a validation error
- Unsupported algorithm value returns an enum validation error
- Key too short for the selected algorithm may return a security constraint error
- Payment not attached or insufficient USDC balance returns a 402 Payment Required

## How this service works

Mint a signed JSON Web Token from a JSON claims object, using a shared secret (HS*) or a PEM private key (RS/ES/PS). Supports expiresInSec, notBeforeSec, issuer, audience, subject and keyid. An unusable key or option is rejected before payment.

## Output

The endpoint returns a signed JWT string (compact serialization: header.payload.signature) that encodes the provided claims, ready to be used as a Bearer token or passed to any JWT-aware service for verification.

## Request schema (JSON Schema)

```json
{
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "type": "object",
 "properties": {
  "input": {
   "type": "object",
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "type": "string",
     "enum": [
      "POST"
     ]
    },
    "bodyType": {
     "type": "string",
     "enum": [
      "json",
      "form-data",
      "text"
     ]
    },
    "body": {
     "type": "object",
     "properties": {
      "payload": {
       "type": "object",
       "description": "The claims to encode (an object)."
      },
      "key": {
       "type": "string",
       "minLength": 1,
       "maxLength": 16384,
       "description": "The HMAC shared secret (HS*) or the PEM-encoded private key (RS/ES/PS)."
      },
      "algorithm": {
       "type": "string",
       "enum": [
        "HS256",
        "HS384",
        "HS512",
        "RS256",
        "RS384",
        "RS512",
        "ES256",
        "ES384",
        "ES512",
        "PS256",
        "PS384",
        "PS512"
       ],
       "description": "Signing algorithm, one of HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512."
      },
      "expiresInSec": {
       "type": "integer",
       "minimum": 0,
       "description": "Set `exp` this many seconds from now."
      },
      "notBeforeSec": {
       "type": "integer",
       "minimum": 0,
       "description": "Set `nbf` this many seconds from now."
      },
      "issuer": {
       "type": "string",
       "description": "Set the `iss` claim."
      },
      "audience": {
       "type": "string",
       "description": "Set the `aud` claim."
      },
      "subject": {
       "type": "string",
       "description": "Set the `sub` claim."
      },
      "keyid": {
       "type": "string",
       "description": "Set the `kid` header."
      },
      "noTimestamp": {
       "type": "boolean",
       "description": "Omit the automatic `iat` claim."
      }
     },
     "required": [
      "payload",
      "key",
      "algorithm"
     ],
     "additionalProperties": false
    }
   },
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "additionalProperties": false
  }
 },
 "required": [
  "input"
 ]
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/jwt-toolkit-sign-e0860182/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from jwt.openverbs.com](https://www.zero.xyz/host/jwt.openverbs.com/llms.txt)