# Vextorium JWT Verifier

> Vextorium JWT Verifier is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-13).

Decodes a JWT and verifies its signature using a JWKS URL (RS256, ES256, EdDSA) or HMAC secret, checking expiry, audience, and issuer, then returns the header, claims, and any reason for invalidity.

## Facts

- Endpoint: POST https://api.vextorium.com/verificar-jwt-pago?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-jwt-verifier-6ee209c9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_udJuHFmfjX1SLXgM-H9s8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-jwt-verifier-6ee209c9 -d '<json body>'
```

Example prompt: Can you verify this JWT for me — 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...' — using the JWKS endpoint at https://example.auth0.com/.well-known/jwks.json, and tell me if the signature is valid, who the issuer is, and the exact reason if it fails?

## When to prefer this

Choose this endpoint when you need to both decode a JWT and cryptographically verify its signature using a public JWKS endpoint (supporting RS256, ES256, EdDSA) or an HMAC secret, especially when you also need to validate standard claims like expiry, audience, and issuer in one call. Prefer it over client-side libraries when operating in an agentic or serverless context where installing crypto dependencies is impractical, or when you need a neutral third-party verification with a detailed failure reason returned as structured data.

## Known failure modes

- Token is malformed or not a valid JWT structure — motivo will describe the parse error
- JWKS URL is unreachable or returns no matching key — motivo explains key lookup failure
- Signature verification fails — valido returns false with motivo detailing the mismatch
- Token is expired — valido is false with motivo indicating expiry
- Audience or issuer mismatch — valido is false with motivo specifying which claim failed
- No secret or JWKS provided — valido is null and motivo states signature was not verified, decode only

## How this service works

Decode a JWT and verify its signature with the public keys of a JWKS URL (RS256, ES256, EdDSA...) or an HMAC secret, checking expiry, audience and issuer; returns header, claims and the exact reason if invalid. Tokens are not stored.

## Output

Returns a JSON object with: 'valido' (boolean or null indicating validity), 'cabecera' (decoded header with alg and typ), 'contenido' (decoded claims/payload), 'algoritmo' (algorithm string), and 'motivo' (a human-readable string explaining the exact reason the token is invalid, or confirmation of decode-only mode if no secret/JWKS was provided). Tokens are never stored server-side.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "required": [
      "token"
     ],
     "properties": {
      "token": {
       "type": "string"
      },
      "emisor": {
       "type": "string"
      },
      "secreto": {
       "type": "string"
      },
      "jwks_url": {
       "type": "string"
      },
      "audiencia": {
       "type": "string"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": [
      "object",
      "null"
     ],
     "properties": {
      "motivo": {
       "type": [
        "string",
        "null"
       ]
      },
      "valido": {},
      "cabecera": {
       "type": [
        "object",
        "null"
       ],
       "properties": {
        "alg": {
         "type": [
          "string",
          "null"
         ]
        },
        "typ": {
         "type": [
          "string",
          "null"
         ]
        }
       }
      },
      "algoritmo": {
       "type": [
        "string",
        "null"
       ]
      },
      "contenido": {
       "type": [
        "object",
        "null"
       ],
       "properties": {
        "iat": {
         "type": [
          "number",
          "null"
         ]
        },
        "sub": {
         "type": [
          "string",
          "null"
         ]
        },
        "name": {
         "type": [
          "string",
          "null"
         ]
        }
       }
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "motivo": "Sin jwks_url ni secreto: solo decodificado, firma NO verificada.",
  "valido": null,
  "cabecera": {
   "alg": "HS256",
   "typ": "JWT"
  },
  "algoritmo": "HS256",
  "contenido": {
   "iat": 1516239022,
   "sub": "1234567890",
   "name": "John Doe"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-jwt-verifier-6ee209c9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)