# JWT Toolkit – Verify

> JWT Toolkit – Verify is a paid API for AI agents from jwt.openverbs.com, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-14).

Verifies a compact JWT token's signature, expiration, and claims against a provided key

## Facts

- Endpoint: POST https://jwt.openverbs.com/v1/verify
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/jwt-toolkit-verify-6cf17cf3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_EW65XJsSnzWLQKdRkmBsa

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability jwt-toolkit-verify-6cf17cf3 -d '<json body>'
```

Example prompt: Verify this JWT for me — token is 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...', the HMAC secret is 'mysecretkey', only allow HS256, and require the issuer to be 'auth.myapp.com'.

## When to prefer this

Use this endpoint when you need a lightweight, pay-per-call JWT verification service without managing your own cryptography libraries or authentication infrastructure. It is particularly useful in agent workflows that need to validate incoming tokens from users or downstream services before proceeding, or in serverless/edge contexts where installing JWT libraries is inconvenient. Supports the full range of HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), and EC (ES256/384/512) algorithms, making it versatile across auth systems.

## Known failure modes

- Invalid or tampered token signature returns a verification failure response
- Expired token without ignoreExpiration flag causes validation to fail
- Algorithm not in the allowed list triggers an algorithm mismatch error
- Issuer, subject, or audience claim mismatch returns a claim validation error
- Malformed JWT (not three base64url segments) returns a parse error
- Incorrect or mismatched key type (e.g. HMAC secret used for RS256 token) causes signature failure
- Missing required fields (token or key) returns a 400-level error

## How this service works

Verify a JSON Web Token's signature and claims against a shared secret (HS*) or a PEM public key (RS/ES/PS). Returns { valid, payload } on success or { valid: false, reason } for a bad signature, expired/not-yet-active token, or a failed issuer/audience/subject check. Pass `algorithms` to pin the accepted signing algorithms and prevent algorithm-confusion attacks.

## Output

The endpoint returns a verification result indicating whether the JWT is valid, along with the decoded payload claims (such as sub, iss, aud, exp, iat) if verification succeeds, or a structured error message describing the failure reason (invalid signature, expired token, claim mismatch, unsupported algorithm, etc.).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object",
     "required": [
      "token",
      "key"
     ],
     "properties": {
      "key": {
       "type": "string",
       "maxLength": 16384,
       "minLength": 1,
       "description": "The HMAC shared secret (HS*) or the PEM-encoded public key (RS/ES/PS)."
      },
      "token": {
       "type": "string",
       "maxLength": 32768,
       "minLength": 1,
       "description": "The compact JWT to verify."
      },
      "issuer": {
       "type": "string",
       "description": "Required `iss` claim value."
      },
      "subject": {
       "type": "string",
       "description": "Required `sub` claim value."
      },
      "audience": {
       "type": "string",
       "description": "Required `aud` claim value."
      },
      "algorithms": {
       "type": "array",
       "items": {
        "enum": [
         "HS256",
         "HS384",
         "HS512",
         "RS256",
         "RS384",
         "RS512",
         "ES256",
         "ES384",
         "ES512",
         "PS256",
         "PS384",
         "PS512"
        ],
        "type": "string"
       },
       "minItems": 1,
       "description": "Accepted signing algorithms (subset of HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512). Strongly recommended."
      },
      "ignoreExpiration": {
       "type": "boolean",
       "description": "Do not treat an expired token as invalid."
      },
      "clockToleranceSec": {
       "type": "integer",
       "maximum": 86400,
       "minimum": 0,
       "description": "Clock skew tolerance in seconds."
      }
     },
     "additionalProperties": false
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/jwt-toolkit-verify-6cf17cf3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from jwt.openverbs.com](https://www.zero.xyz/host/jwt.openverbs.com/llms.txt)