# MoneyTools JWT Inspector & JWKS Verifier

> MoneyTools JWT Inspector & JWKS Verifier is a paid API for AI agents from tools.moneytools.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-11-05).

Decodes a JWT, explains its claims and expiry, and cryptographically verifies RS/PS/ES/EdDSA signatures against a provided JWKS URL or the issuer's OIDC discovery endpoint

## Facts

- Endpoint: POST https://tools.moneytools.dev/v1/jwt?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-05
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/moneytools-jwt-inspector-jwks-verifier-7563e954
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7RWh2K1e8qby967dzfQfN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability moneytools-jwt-inspector-jwks-verifier-7563e954 -d '<json body>'
```

Example prompt: Can you decode this JWT and verify its signature using the JWKS endpoint at https://example.auth0.com/.well-known/jwks.json — tell me if it's expired and explain its claims: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNzAwMDAwMDAwfQ.abc123

## When to prefer this

Use this endpoint when you need to decode and cryptographically verify a JWT with an asymmetric signature (RS256, PS256, ES256, EdDSA) without handling private keys or secrets. It's ideal for debugging auth failures, auditing third-party tokens, or validating OIDC identity tokens from providers like Google, Auth0, or Azure AD. Prefer this over manual JWKS fetching when you want claim explanations and expiry analysis in one call. Not suitable for HS256/symmetric tokens (which require the shared secret).

## Known failure modes

- Invalid JWT format — token cannot be parsed (malformed base64 or missing segments)
- JWKS URL unreachable or returns non-200 response
- No matching key ID (kid) found in the JWKS for this token
- Unsupported algorithm (e.g. HS256 symmetric — requires a secret, not supported)
- OIDC discovery failed — issuer URL does not expose /.well-known/openid-configuration
- Token is valid but signature verification fails (tampered payload)
- Rate limit exceeded on free tier (10/day) without payment credentials

## How this service works

JWT inspector + JWKS verify: Decode a JWT, explain its claims (expired? lifetime?) and verify RS/PS/ES/EdDSA signatures against a public JWKS URL or the issuer's OIDC discovery. No secrets needed or stored. Free tier 10/day; then $0.002 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.002 USDC per call via x402 on Base. Run by MoneyTools.

## Output

Returns the decoded JWT header and payload with human-readable explanations of each claim (e.g. expiry status, lifetime, subject, audience), plus a cryptographic signature verification result indicating whether the token is valid against the provided JWKS URL or OIDC-discovered public keys. No private keys or secrets are required or stored.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "token": {
   "type": "string",
   "examples": [
    "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwiZXhwIjoxfQ.x"
   ],
   "description": "JWT"
  },
  "jwksUrl": {
   "type": "string",
   "description": "JWKS URL"
  },
  "discover": {
   "type": "boolean",
   "examples": [
    "false"
   ],
   "description": "true = use iss OIDC discovery"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/moneytools-jwt-inspector-jwks-verifier-7563e954/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.moneytools.dev](https://www.zero.xyz/host/tools.moneytools.dev/llms.txt)