Which signing algorithms does the JWT API support?

The API supports six algorithms across two families. The symmetric (shared-secret) algorithms are HS256, HS384, and HS512. The asymmetric (key-pair) algorithms are RS256, ES256, and PS256. HS256 is the default if you don't specify an alg. Symmetric algorithms require a secret; asymmetric algorithms require a PEM PKCS8 private key to sign and a PEM SPKI public key to verify.

What's the difference between /v1/verify and /v1/decode?

/v1/verify performs full cryptographic validation: it checks the signature against your key material and enforces the exp/nbf time claims plus any issuer and audience you supply. /v1/decode does NOT verify anything — it simply Base64URL-decodes the header and payload so you can inspect them, and it returns an explicit warning. You should never trust decoded data for authorization; always run untrusted tokens through /v1/verify first.

How does the API protect against JWT algorithm-confusion attacks?

Algorithm-confusion attacks trick a verifier into using an asymmetric public key as an HMAC secret by swapping the token header to a symmetric algorithm. To defend against this, pass the algorithms array on /v1/verify to pin exactly which algorithms you accept (e.g. ['ES256']). The API will reject any token whose algorithm isn't in your allowlist, so forged tokens fail verification outright.

What happens when I verify a bad or expired token?

A tampered, expired, or claim-mismatched token does not raise a 500 error. Instead /v1/verify returns HTTP 200 with a body like { "valid": false, "error": "signature verification failed", "code": "ERR_JWS_SIGNATURE_VERIFICATION_FAILED" }. This keeps client logic simple — you just branch on the valid boolean. A 400 is only returned for malformed requests, such as a missing token or invalid key material.

How do I set a token's expiration?

Use the expiresIn field on /v1/sign. It accepts a human-readable duration string such as '2h', '30m', or '7d', or a raw positive number of seconds from now. expiresIn takes precedence over any exp value you place in the payload. The iat (issued-at) claim is always added automatically when the token is signed.

Do I authenticate with a query parameter or a header?

Both are supported. Pass your key as the apikey query parameter (e.g. ?apikey=YOUR_KEY), or send it in an X-Api-Key header. You don't need to do anything extra in your request body either way.

Is the JWT API fast enough for production authentication?

Yes. The API runs on a global edge network of 300+ locations using native WebCrypto, with sub-10ms cold paths and a 99.9% uptime SLA. Because verification is stateless and self-contained, it adds negligible latency to request handling, making it well-suited for gateway and microservice authentication at scale. Paid tiers offer up to 200 requests per second and 5,000,000 requests per month.

Sign, verify, and decode JSON Web Tokens at the edge

JWT API

The JWT API is a production-grade JSON Web Token service running on a global edge network. Built on the battle-tested jose library with native WebCrypto, it lets you sign new tokens, cryptographically verify incoming ones, and decode any token for inspection — all without standing up your own auth infrastructure.

Supports the full range of algorithms used in production: symmetric HS256/HS384/HS512 (shared secret) and asymmetric RS256/ES256/PS256 (PEM PKCS8 to sign, PEM SPKI to verify). The verify endpoint enforces exp/nbf, issuer, and audience claims and guards against the classic JWT algorithm-confusion attack by pinning accepted algorithms to your key material.

Get a free API key Read the docs

Free tier included, no credit card required. One key works across every API.

Free calls / month: 1,000
Algorithms: 6
Cold Path: <10ms
Uptime SLA: 99.9%

Get your free API key

1,000 free calls on the free plan

Key features

Sign / mint tokens with automatic iat and flexible expiresIn durations
Cryptographic verification of signature and claims
Decode any token to inspect header and payload without verifying
Symmetric HS256/HS384/HS512 with shared secrets
Asymmetric RS256/ES256/PS256 with PEM keys
exp/nbf, issuer, and audience claim enforcement
Algorithm-confusion protection via accepted-algorithm pinning

Built for

Microservice and service-to-service authentication
API gateway token issuance and validation
Webhook signature verification
Stateless session and access tokens
Short-lived signed links and download URLs
Single sign-on and identity propagation
Token inspection and debugging during development
Offloading crypto from constrained or serverless clients

MCP · for your agent

Hand the JWT API to your agent

Connect Claude, Cursor or any MCP client once, then ask in plain words. Your agent finds this API, reads its docs and makes the call: 1 credit per call, the same as REST, from your team's balance.

Connect your agent

Mint a token for testing

“Mint a 15-minute test token for user_42 with role 'admin', audience 'billing-api' and a unique ID, using our staging secret.”

list_apis · get_api_docsfree

api_request POST /jwt/v1/sign 1 cr

+ Developer Toolbox API1 cr

A signed HS256 token expiring in 15 minutes, with a fresh UUID as its jti claim.

Debug a rejected token

“Our API rejects this token with a 401. Verify it against the staging secret and tell me which check fails.”

list_apis · get_api_docsfree

api_request POST /jwt/v1/verify 1 cr

Whether it's valid, and if not, the exact reason: expired, bad signature, audience or issuer.

Inspect a token's claims

“What's inside the token from this failing mobile request? When was it issued, when does it expire, and what's the role?”

list_apis · get_api_docsfree

api_request GET /jwt/v1/decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.abc123 1 cr

Decoded header and claims with issue and expiry times as dates, marked as unverified.

$ claude mcp add --transport http apicodex https://mcp.apicodex.io

Illustrative asks; the calls and prices are real. Claude, Cursor, VS Code and Windsurf setup: mcp.apicodex.io

Try it

Build the request for your data

Edit the parameters below and see the exact request and curl command you'd send. No key required to preview.

POST /jwt/v1/sign

Open in Playground

Parameters

apikey

Request · HTTP

POST /jwt/v1/sign?apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io
Content-Type: application/json

{
  "payload": { "sub": "user_42", "role": "admin" },
  "alg": "HS256",
  "secret": "super-secret-value",
  "expiresIn": "2h",
  "issuer": "https://auth.example.com",
  "audience": "my-app"
}

Response · JSON 200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.r3kY8Qw2..."
}

Run it with your key

Documentation

JWT API Documentation

The JWT API exposes three endpoints: POST /v1/sign to issue tokens with automatic iat and flexible expiresIn durations, POST /v1/verify for full cryptographic validation of signature and claims, and GET /v1/decode to inspect any token without trusting it. Symmetric algorithms use a shared secret; asymmetric algorithms use PEM PKCS8 private keys to sign and PEM SPKI public keys to verify.

Base URL

url

https://api.apicodex.io/jwt

Authentication

Authenticate by passing your API key as the apikey query parameter, or by sending it in an X-Api-Key header:

headers

// Query parameter
https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY

// Header
{
  "X-Api-Key": "YOUR_API_KEY"
}

Request and response

Illustrative values. Confirm current endpoint behavior, quotas, and data freshness in the API documentation before production use.

request · http

POST /jwt/v1/sign?apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io
Content-Type: application/json

{
  "payload": { "sub": "user_42", "role": "admin" },
  "alg": "HS256",
  "secret": "super-secret-value",
  "expiresIn": "2h",
  "issuer": "https://auth.example.com",
  "audience": "my-app"
}

response · json

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.r3kY8Qw2..."
}

Code examples

cURL

curl --request POST \
  --url 'https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "payload": { "sub": "user_42", "role": "admin" },
    "alg": "HS256",
    "secret": "super-secret-value",
    "expiresIn": "2h",
    "issuer": "https://auth.example.com",
    "audience": "my-app"
  }'

JavaScript/Node.js

const res = await fetch(
  'https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY',
  {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      payload: { sub: 'user_42', role: 'admin' },
      alg: 'HS256',
      secret: 'super-secret-value',
      expiresIn: '2h',
      issuer: 'https://auth.example.com',
      audience: 'my-app'
    })
  }
);

const { token } = await res.json();
console.log(token);

// Verify it back
const verifyRes = await fetch(
  'https://api.apicodex.io/jwt/v1/verify?apikey=YOUR_KEY',
  {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      token,
      secret: 'super-secret-value',
      algorithms: ['HS256']
    })
  }
);

console.log(await verifyRes.json());

Python

import requests

params = {"apikey": "YOUR_KEY"}

# Sign a token
sign = requests.post(
    "https://api.apicodex.io/jwt/v1/sign",
    params=params,
    json={
        "payload": {"sub": "user_42", "role": "admin"},
        "alg": "HS256",
        "secret": "super-secret-value",
        "expiresIn": "2h",
        "issuer": "https://auth.example.com",
        "audience": "my-app",
    },
)
token = sign.json()["token"]
print(token)

# Verify it back
verify = requests.post(
    "https://api.apicodex.io/jwt/v1/verify",
    params=params,
    json={"token": token, "secret": "super-secret-value", "algorithms": ["HS256"]},
)
print(verify.json())

Endpoints

POST /v1/sign

Sign / mint a JWT. Supply a payload plus the key material for your chosen algorithm. iat is set automatically and expiresIn controls exp.

curl -X POST "https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"payload":{"sub":"user_42"},"alg":"HS256","secret":"super-secret-value","expiresIn":"2h"}'

POST /v1/verify

Verify a JWT signature and claims. Returns valid:true with payload+header on success, or valid:false with error+code (HTTP 200) for a bad, expired, or claim-mismatched token.

curl -X POST "https://api.apicodex.io/jwt/v1/verify?apikey=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"token":"eyJhbGci...","secret":"super-secret-value","algorithms":["HS256"]}'

GET /v1/decode

Decode a JWT WITHOUT verifying it. Returns the unverified header and payload plus a warning. Use only for inspection; never trust the data.

curl "https://api.apicodex.io/jwt/v1/decode?token=eyJhbGci...&apikey=YOUR_KEY"

Sign Parameters

Required parameters

payload Custom claims to embed as a JSON object. iat is set automatically.

Optional parameters

alg Signing algorithm: HS256, HS384, HS512, RS256, ES256, or PS256. Defaults to HS256.
secret Shared secret. Required for HS* algorithms.
privateKey PEM-encoded PKCS8 private key. Required for RS*/ES*/PS* algorithms.
expiresIn Duration string (e.g. '2h', '30m', '7d') or seconds-from-now. Takes precedence over any exp in payload.
issuer Value to set as the iss claim.
audience Value to set as the aud claim (string or array of strings).
subject Value to set as the sub claim.

Verify Parameters

Required parameters

token The compact JWS to verify.

Optional parameters

secret Shared secret. Required for HS* algorithms.
publicKey PEM-encoded SPKI public key. Required for RS*/ES*/PS* algorithms.
algorithms Array restricting accepted algorithms (defends against alg-confusion), e.g. ['HS256'].
issuer Expected iss claim; verification fails on mismatch.
audience Expected aud claim (string or array); verification fails on mismatch.

Pricing

JWT API Pricing

This API costs 1 credit per request. Credits are shared across every API on your plan.

Estimate your monthly cost

Drag the slider to match your expected request volume. We'll recommend the cheapest plan that covers it.

Requests per month 10,000

Recommended plan

Starter

$29.99 /month

Credits used

Credits included

Cost per 1K requests

Choose Starter

Free

1,000 credits · ~1,000 requests/mo · 2 rps

All APIs included
No credit card required
Full documentation and examples
MCP server for your AI agents
Up to 5 active API keys

Start for free

Starter

Popular

$29.99 /month

50,000 credits · ~50,000 requests/mo · 10 rps

All APIs included
Email support
Usage dashboard and analytics
MCP server for your AI agents
Up to 5 active API keys

Start with Starter

Pro

$99.99 /month

250,000 credits · ~250,000 requests/mo · 25 rps

All APIs included
Priority support
MCP server for your AI agents
Up to 5 active API keys

Start with Pro

FAQ

JWT API

Key features

Built for

Hand the JWT API to your agent

Mint a token for testing

Debug a rejected token

Inspect a token's claims

Build the request for your data

JWT API Documentation

Base URL

Authentication

Request and response

Code examples

Endpoints

POST /v1/sign

POST /v1/verify

GET /v1/decode

Sign Parameters

Required parameters

Optional parameters

Verify Parameters

Required parameters

Optional parameters

JWT API Pricing

Free

Starter

Pro

Need a different plan?

Frequently asked questions

Related APIs