# Tanod utilpeek JWT Verifier

> Tanod utilpeek JWT Verifier is a paid API for AI agents from tanod.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-11).

Verifies a JWT's cryptographic signature, expiry, audience, and issuer using a shared HMAC secret, PEM public key, or JWK Set

## Facts

- Endpoint: POST https://tanod.dev/v1/jwt/verify?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-utilpeek-jwt-verifier-c28f4786
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZLIfCTPwPFN3E_Ec1j_Wm

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-utilpeek-jwt-verifier-c28f4786 -d '<json body>'
```

Example prompt: Verify this JWT for me — check its signature using this PEM public key, confirm the issuer is 'https://auth.example.com' and the audience is 'api.example.com', and allow up to 10 seconds of clock skew: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

## When to prefer this

Choose this endpoint when an agent needs to cryptographically verify a JWT — checking signature, expiry, issuer, and audience — without embedding a full JWT library. Ideal for lightweight agents, serverless workflows, or polyglot environments where pulling in a crypto dependency is undesirable. Supports all major key types: HMAC secrets for symmetric tokens, PEM public keys for asymmetric tokens, and JWK Sets for multi-key rotation scenarios typical in OAuth/OIDC flows.

## Known failure modes

- Invalid or malformed JWT returns a parse error
- Expired token (outside leeway) returns expiry failure
- Signature mismatch with provided secret or key returns verification failure
- Issuer or audience claim mismatch returns claim validation error
- Algorithm not in allow-list returns algorithm rejection error
- No key material provided (no secret, public_key, or jwks) returns configuration error
- JWK Set missing the key matching the token's kid returns key-not-found error

## How this service works

One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.

## Output

Returns whether the JWT signature is valid and all specified claims (exp, aud, iss) pass verification, along with details on any failures such as signature mismatch, token expiry, wrong issuer, or unmatched audience

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "jwks": {
   "anyOf": [
    {
     "type": "object",
     "additionalProperties": true
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "JWK Set object {\"keys\": [...]} (asymmetric keys; oct keys are ignored). The key is picked by the token kid."
  },
  "token": {
   "type": "string",
   "maxLength": 16000,
   "minLength": 1,
   "description": "Compact JWT to verify."
  },
  "issuer": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 2048,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "Required iss."
  },
  "secret": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 4096,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "HMAC secret (HS256/384/512)."
  },
  "audience": {
   "anyOf": [
    {
     "type": "string"
    },
    {
     "type": "array",
     "items": {
      "type": "string"
     }
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "Required aud (a string, or a list of which one must match)."
  },
  "algorithms": {
   "anyOf": [
    {
     "type": "array",
     "items": {
      "type": "string"
     },
     "maxItems": 8,
     "minItems": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "Allow-list that narrows the default for the key type; none is refused."
  },
  "public_key": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 12000,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "PEM public key (RS*, PS*, ES*, EdDSA)."
  },
  "leeway_seconds": {
   "type": "integer",
   "default": 0,
   "maximum": 300,
   "minimum": 0,
   "description": "Clock skew allowed for exp, nbf and iat (0-300)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "alg": "HS256",
  "kid": null,
  "note": "Signature and the claims you asked about were checked with PyJWT. Algorithm none is refused, and the accepted algorithms follow the key type. exp, nbf and iat are checked; aud and iss when given.",
  "valid": false,
  "detail": "the signature does not match this key",
  "reason": "bad_signature",
  "key_source": "secret"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-utilpeek-jwt-verifier-c28f4786/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tanod.dev](https://www.zero.xyz/host/tanod.dev/llms.txt)