APIs › Agent & Developer Utilities › JWT Inspector

JWT Inspector

Decodes JWT header and claims, evaluates temporal claims, and verifies the signature only when a verification key is explicitly supplied.

POST /v1/developer/jwt-inspect $0.003 per call

Specification

Endpoint

POST /v1/developer/jwt-inspect

Price

$0.003 per call · tier micro_data

Payment

x402 on X Layer (chain 196) · settled in USDG or USDT0 · schemes exact, aggr_deferred

Data source

Deterministic local computation on caller-supplied input

Timeout

15 seconds

Max request

2 MB

Version

1.0.0

Calling it

The first call returns a 402 with the payment challenge. Retry with a signed authorisation in the X-PAYMENT header — see the payment guide for the exact shape.

curl -i -X POST "https://api.dana-edu.pp.ua/v1/developer/jwt-inspect" \
  -H "content-type: application/json" \
  -d '{ ... }'

Response

Real output, captured by running this endpoint at build time — not written by hand. Volatile fields such as timestamps are elided. Captured 2026-07-30.

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "claims": {
    "sub": "1234",
    "name": "Dana",
    "exp": 1700000000
  },
  "temporal": {
    "expired": true,
    "expires_at": "<varies per call>",
    "seconds_until_expiry": "<varies per call>",
    "not_before_ok": true,
    "issued_at": "<varies per call>"
  },
  "signature_present": true,
  "signature_verified": null,
  "signature_note": "No verification_key was supplied, so the signature was NOT verified. The claims below are unauthenticated and must not be trusted for access control.",
  "standard_claims_present": [
    "exp",
    "sub"
  ],
  "warnings": [
    "alg is HS256; confirm the issuer actually uses a symmetric key. An attacker who can switch an RS256 token to HS256 and sign it with the public key defeats verification."
  ]
}

Every response is wrapped in the same envelope: data plus warnings, sources, confidence, informational_only and a measured processing_ms. See the envelope reference.

Related endpoints