JWT API
The JWT API is a production-grade JSON Web Token service running on a global edge network. Built on the battle-tested jose library with native WebCrypto, it lets you sign new tokens, cryptographically verify incoming ones, and decode any token for inspection — all without standing up your own auth infrastructure.
Supports the full range of algorithms used in production: symmetric HS256/HS384/HS512 (shared secret) and asymmetric RS256/ES256/PS256 (PEM PKCS8 to sign, PEM SPKI to verify). The verify endpoint enforces exp/nbf, issuer, and audience claims and guards against the classic JWT algorithm-confusion attack by pinning accepted algorithms to your key material.
Free tier · no credit card · billed on RapidAPI
Key features
- Sign / mint tokens with automatic iat and flexible expiresIn durations
- Cryptographic verification of signature and claims
- Decode any token to inspect header and payload without verifying
- Symmetric HS256/HS384/HS512 with shared secrets
- Asymmetric RS256/ES256/PS256 with PEM keys
- exp/nbf, issuer, and audience claim enforcement
- Algorithm-confusion protection via accepted-algorithm pinning
Perfect for
- Microservice and service-to-service authentication
- API gateway token issuance and validation
- Webhook signature verification
- Stateless session and access tokens
- Short-lived signed links and download URLs
- Single sign-on and identity propagation
- Token inspection and debugging during development
- Offloading crypto from constrained or serverless clients
JWT API Documentation
Everything you need to integrate — base URL, auth, and copy-paste examples.
The JWT API exposes three endpoints: POST /v1/sign to issue tokens with automatic iat and flexible expiresIn durations, POST /v1/verify for full cryptographic validation of signature and claims, and GET /v1/decode to inspect any token without trusting it. Symmetric algorithms use a shared secret; asymmetric algorithms use PEM PKCS8 private keys to sign and PEM SPKI public keys to verify.
Base URL
https://edge-apis.e9736.workers.devAuthentication
Authenticate by passing your API key as the apikey query parameter, or call via RapidAPI which injects the proxy secret automatically:
// Direct (query param)
https://edge-apis.e9736.workers.dev/v1/sign?apikey=YOUR_KEY
// Via RapidAPI (headers)
{
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
"X-RapidAPI-Host": "jwt-api.p.rapidapi.com"
}Request & response
POST /v1/sign?apikey=YOUR_KEY HTTP/1.1
Content-Type: application/json
{
"payload": { "sub": "user_42", "role": "admin" },
"alg": "HS256",
"secret": "super-secret-value",
"expiresIn": "2h",
"issuer": "https://edge-apis.e9736.workers.dev",
"audience": "my-app"
}{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.r3kY8Qw2..."
}Code examples
curl --request POST \
--url 'https://edge-apis.e9736.workers.dev/v1/sign?apikey=YOUR_KEY' \
--header 'Content-Type: application/json' \
--data '{
"payload": { "sub": "user_42", "role": "admin" },
"alg": "HS256",
"secret": "super-secret-value",
"expiresIn": "2h",
"issuer": "https://edge-apis.e9736.workers.dev",
"audience": "my-app"
}'Endpoints
POST /v1/sign
Sign / mint a JWT. Supply a payload plus the key material for your chosen algorithm. iat is set automatically and expiresIn controls exp.
curl -X POST "https://edge-apis.e9736.workers.dev/v1/sign?apikey=YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"payload":{"sub":"user_42"},"alg":"HS256","secret":"super-secret-value","expiresIn":"2h"}'POST /v1/verify
Verify a JWT signature and claims. Returns valid:true with payload+header on success, or valid:false with error+code (HTTP 200) for a bad, expired, or claim-mismatched token.
curl -X POST "https://edge-apis.e9736.workers.dev/v1/verify?apikey=YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"token":"eyJhbGci...","secret":"super-secret-value","algorithms":["HS256"]}'GET /v1/decode
Decode a JWT WITHOUT verifying it. Returns the unverified header and payload plus a warning. Use only for inspection; never trust the data.
curl "https://edge-apis.e9736.workers.dev/v1/decode?token=eyJhbGci...&apikey=YOUR_KEY"Sign Parameters
Required Parameters
payload- Custom claims to embed as a JSON object. iat is set automatically.
Optional Parameters
alg- Signing algorithm: HS256, HS384, HS512, RS256, ES256, or PS256. Defaults to HS256.secret- Shared secret. Required for HS* algorithms.privateKey- PEM-encoded PKCS8 private key. Required for RS*/ES*/PS* algorithms.expiresIn- Duration string (e.g. '2h', '30m', '7d') or seconds-from-now. Takes precedence over any exp in payload.issuer- Value to set as the iss claim.audience- Value to set as the aud claim (string or array of strings).subject- Value to set as the sub claim.
Verify Parameters
Required Parameters
token- The compact JWS to verify.
Optional Parameters
secret- Shared secret. Required for HS* algorithms.publicKey- PEM-encoded SPKI public key. Required for RS*/ES*/PS* algorithms.algorithms- Array restricting accepted algorithms (defends against alg-confusion), e.g. ['HS256'].issuer- Expected iss claim; verification fails on mismatch.audience- Expected aud claim (string or array); verification fails on mismatch.
JWT API Pricing
Choose the right plan for your token signing and verification needs with flexible pricing and no hidden fees
Basic
- All 6 algorithms
- Sign, verify & decode
- 3 req/sec rate limit
Pro
- All 6 algorithms
- Sign, verify & decode
- 30 req/sec rate limit
Ultra
- All 6 algorithms
- Sign, verify & decode
- 200 req/sec rate limit
Need higher volume or a custom SLA?
Talk to us about enterprise rates, dedicated support, and compliance docs.
Frequently asked questions
The API supports six algorithms across two families. The symmetric (shared-secret) algorithms are HS256, HS384, and HS512. The asymmetric (key-pair) algorithms are RS256, ES256, and PS256. HS256 is the default if you don't specify an alg. Symmetric algorithms require a secret; asymmetric algorithms require a PEM PKCS8 private key to sign and a PEM SPKI public key to verify.
/v1/verify performs full cryptographic validation: it checks the signature against your key material and enforces the exp/nbf time claims plus any issuer and audience you supply. /v1/decode does NOT verify anything — it simply Base64URL-decodes the header and payload so you can inspect them, and it returns an explicit warning. You should never trust decoded data for authorization; always run untrusted tokens through /v1/verify first.
Algorithm-confusion attacks trick a verifier into using an asymmetric public key as an HMAC secret by swapping the token header to a symmetric algorithm. To defend against this, pass the algorithms array on /v1/verify to pin exactly which algorithms you accept (e.g. ['ES256']). The API will reject any token whose algorithm isn't in your allowlist, so forged tokens fail verification outright.
A tampered, expired, or claim-mismatched token does not raise a 500 error. Instead /v1/verify returns HTTP 200 with a body like { "valid": false, "error": "signature verification failed", "code": "ERR_JWS_SIGNATURE_VERIFICATION_FAILED" }. This keeps client logic simple — you just branch on the valid boolean. A 400 is only returned for malformed requests, such as a missing token or invalid key material.
Use the expiresIn field on /v1/sign. It accepts a human-readable duration string such as '2h', '30m', or '7d', or a raw positive number of seconds from now. expiresIn takes precedence over any exp value you place in the payload. The iat (issued-at) claim is always added automatically when the token is signed.
Both are supported. When calling the edge endpoint directly, pass your key as the apikey query parameter (e.g. ?apikey=YOUR_KEY). When subscribing through RapidAPI, send the X-RapidAPI-Key and X-RapidAPI-Host headers instead, and RapidAPI injects the proxy secret automatically. You don't need to do anything extra in your request body either way.
Yes. The API runs on a global edge network of 300+ locations using native WebCrypto, with sub-10ms cold paths and a 99.9% uptime SLA. Because verification is stateless and self-contained, it adds negligible latency to request handling, making it well-suited for gateway and microservice authentication at scale. Paid tiers offer up to 200 requests per second and 5,000,000 requests per month.
Related APIs & tools
Other services that pair well — all on the same key.
Email Intelligence API
Validate email addresses with comprehensive DNS/MX record checking and deliverability scoring.
Learn more→DNS Lookup API
Advanced DNS querying with support for all record types and reverse lookups.
Learn more→Text Anonymization API
AI-powered PII detection and redaction for GDPR/CCPA compliance.
Learn more→Every week you build in-house is a week you don't ship product
2,500+ teams already made the switch. Start with a free tier today, or talk to us about your enterprise needs.
For developers
Free tier, no credit card. Integrate your first API in under 30 minutes.
Get API keys freeRead the docsFor teams and enterprise
Custom volumes, SLA guarantees, dedicated support, and compliance documentation.
Talk to salesor email sales@apicodex.io