# Swift Bot Labs JWT Decode & Verify

> Swift Bot Labs JWT Decode & Verify is a paid API for AI agents from x402-toolbox.swiftbotlab.workers.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-31).

Decodes a JWT token into its header, payload, and timestamp fields, and optionally verifies its HMAC signature against a provided secret.

## Facts

- Endpoint: POST https://x402-toolbox.swiftbotlab.workers.dev/v1/jwt/decode?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/swift-bot-labs-jwt-decode-verify-362ee3e0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xLwbab0dRhaBX2rdek9cO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability swift-bot-labs-jwt-decode-verify-362ee3e0 -d '<json body>'
```

Example prompt: Decode this JWT for me and verify its signature using the secret 'mysecret' (UTF-8): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c — show me the header, payload, expiry status, and whether the signature is valid.

## When to prefer this

Use this endpoint when you need a quick, serverless JWT decode or HMAC signature check without importing a JWT library or spinning up infrastructure. Ideal for AI agents operating in sandboxed environments, scripts needing one-off token inspection, or workflows that need to verify HS256 tokens on demand. Pay-per-call with no account setup makes it convenient for low-volume or ad-hoc use cases.

## Known failure modes

- Malformed JWT string (not three dot-separated base64 parts) returns an error
- Wrong or mismatched secret causes signatureVerified: false rather than an error
- Incorrect secretEncoding (e.g. passing raw bytes as utf8) yields failed verification
- Payment failure via x402 if USDC balance is insufficient
- Token exceeds 16384 character limit
- Missing required token field returns validation error

## How this service works

62 small, deterministic utility APIs (DNS and e-mail checks, web extraction, EVM decoding, x402 checks, IP math, JSON/CSV, hashing, conversions). No account or API key: pay per call in USDC with x402.

## Output

A JSON object with ok=true and a result containing: the decoded header (algorithm, type), decoded payload (all claims), issued-at and other timestamps formatted as ISO 8601 strings, an expired boolean, and a signatureVerified boolean if a secret was provided.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "token": {
   "type": "string",
   "maxLength": 16384
  },
  "secret": {
   "type": "string",
   "maxLength": 4096,
   "description": "Optional HMAC secret to verify the signature"
  },
  "secretEncoding": {
   "enum": [
    "utf8",
    "base64",
    "hex"
   ],
   "type": "string",
   "default": "utf8"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "tool": "jwt-decode",
  "result": {
   "times": {
    "iat": "2018-01-18T01:30:22.000Z"
   },
   "header": {
    "alg": "HS256",
    "typ": "JWT"
   },
   "expired": false,
   "payload": {
    "iat": 1516239022,
    "sub": "1234567890",
    "name": "John Doe"
   },
   "signatureVerified": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/swift-bot-labs-jwt-decode-verify-362ee3e0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-toolbox.swiftbotlab.workers.dev](https://www.zero.xyz/host/x402-toolbox.swiftbotlab.workers.dev/llms.txt)