# Sicher JWT Verify

> Sicher JWT Verify is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-10).

Verifies a JWT's structure, claims (expiry, nbf, iat, issuer, audience, lifetime), and cryptographic signature (HMAC, RSA, RSA-PSS, ECDSA) against a shared secret, PEM key, or JWKS endpoint.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/jwt-verify?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sicher-jwt-verify-c61bb30a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_o7SMXEGROjdxU3Z-tMPb9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sicher-jwt-verify-c61bb30a -d '<json body>'
```

Example prompt: Check whether this JWT is valid — verify the signature using our JWKS at https://auth.example.com/.well-known/jwks.json, expect issuer 'https://auth.example.com' and audience 'my-api', and allow up to 30 seconds of clock skew.

## When to prefer this

Choose this endpoint when you need server-side, authoritative JWT verification with multi-layer checks (structure + claims + cryptographic signature) and need to support multiple algorithm families (HMAC, RSA, RSA-PSS, ECDSA) and key sources (shared secret, PEM, JWKS). Ideal for agentic pipelines where the agent must authenticate inbound requests or validate identity tokens before taking action, without implementing crypto logic itself.

## Known failure modes

- Expired token: validation fails with expiry check error
- Signature mismatch: fails if secret or key does not match
- JWKS fetch failure: unreachable or malformed JWKS URL causes error
- kid not found: token's key ID missing from provided JWKS
- Issuer/audience mismatch: claims don't match expected values
- Malformed JWT: unparseable token structure returns parse error
- nbf in the future: token not yet valid, fails not-before check

## How this service works

Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key.

## Output

Returns a structured result indicating whether the JWT passed or failed validation, which specific checks succeeded or failed (signature, expiry, nbf, iat, issuer, audience, lifetime), the decoded payload claims, and details about which key (kid) was matched if a JWKS was used.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "token": {
   "type": "string",
   "maxLength": 20000,
   "minLength": 10,
   "description": "The JWT in compact form."
  },
  "secret": {
   "type": "string",
   "maxLength": 2000,
   "description": "Shared secret for HS256/384/512."
  },
  "jwks_url": {
   "type": "string",
   "maxLength": 2000,
   "description": "JWKS endpoint; the key is picked by kid."
  },
  "public_key_pem": {
   "type": "string",
   "maxLength": 8000,
   "description": "PEM public key for RS/PS/ES algorithms."
  },
  "expected_issuer": {
   "type": "string",
   "maxLength": 500,
   "description": "Issuer the token must carry."
  },
  "expected_audience": {
   "type": "string",
   "maxLength": 500,
   "description": "Audience the token must name."
  },
  "clock_skew_seconds": {
   "type": "integer",
   "default": 60,
   "maximum": 3600,
   "minimum": 0,
   "description": "Tolerance for exp and nbf."
  },
  "max_lifetime_seconds": {
   "type": "integer",
   "minimum": 1,
   "description": "Flag tokens valid for longer than this."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sicher-jwt-verify-c61bb30a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)