Sign, verify, and decode JSON Web Tokens at the edge
JWT API
The JWT API is a production-grade JSON Web Token service running on a global edge network. Built on the battle-tested jose library with native WebCrypto, it lets you sign new tokens, cryptographically verify incoming ones, and decode any token for inspection — all without standing up your own auth infrastructure.
Supports the full range of algorithms used in production: symmetric HS256/HS384/HS512 (shared secret) and asymmetric RS256/ES256/PS256 (PEM PKCS8 to sign, PEM SPKI to verify). The verify endpoint enforces exp/nbf, issuer, and audience claims and guards against the classic JWT algorithm-confusion attack by pinning accepted algorithms to your key material.
Free tier included, no credit card required. One key works across all 49 APIs.
- Algorithms
- 6
- Cold Path
- <10ms
- Uptime SLA
- 99.9%
Key features
- Sign / mint tokens with automatic iat and flexible expiresIn durations
- Cryptographic verification of signature and claims
- Decode any token to inspect header and payload without verifying
- Symmetric HS256/HS384/HS512 with shared secrets
- Asymmetric RS256/ES256/PS256 with PEM keys
- exp/nbf, issuer, and audience claim enforcement
- Algorithm-confusion protection via accepted-algorithm pinning
Built for
- Microservice and service-to-service authentication
- API gateway token issuance and validation
- Webhook signature verification
- Stateless session and access tokens
- Short-lived signed links and download URLs
- Single sign-on and identity propagation
- Token inspection and debugging during development
- Offloading crypto from constrained or serverless clients
Try it
Build the request for your data
Edit the parameters below and see the exact curl command and JSON response you will get. No key required to preview.
Parameters
POST /jwt/v1/sign?apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io
Content-Type: application/json
"payload": { "sub": "user_42", "role": "admin" },
"alg": "HS256",
"secret": "super-secret-value",
"expiresIn": "2h",
"issuer": "https://api.apicodex.io/jwt",
"audience": "my-app"
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.r3kY8Qw2..."
}Documentation
JWT API Documentation
The JWT API exposes three endpoints: POST /v1/sign to issue tokens with automatic iat and flexible expiresIn durations, POST /v1/verify for full cryptographic validation of signature and claims, and GET /v1/decode to inspect any token without trusting it. Symmetric algorithms use a shared secret; asymmetric algorithms use PEM PKCS8 private keys to sign and PEM SPKI public keys to verify.
Base URL
https://api.apicodex.io/jwtAuthentication
Authenticate by passing your API key as the apikey query parameter, or by sending it in an X-Api-Key header:
// Query parameter
https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY
// Header
{
"X-Api-Key": "YOUR_API_KEY"
}Request and response
Illustrative values. Confirm current endpoint behavior, quotas, and data freshness in the API documentation before production use.
POST /v1/sign?apikey=YOUR_KEY HTTP/1.1
Content-Type: application/json
{
"payload": { "sub": "user_42", "role": "admin" },
"alg": "HS256",
"secret": "super-secret-value",
"expiresIn": "2h",
"issuer": "https://api.apicodex.io/jwt",
"audience": "my-app"
}{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIn0.r3kY8Qw2..."
}Code examples
curl --request POST \
--url 'https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY' \
--header 'Content-Type: application/json' \
--data '{
"payload": { "sub": "user_42", "role": "admin" },
"alg": "HS256",
"secret": "super-secret-value",
"expiresIn": "2h",
"issuer": "https://api.apicodex.io/jwt",
"audience": "my-app"
}'Endpoints
POST /v1/sign
Sign / mint a JWT. Supply a payload plus the key material for your chosen algorithm. iat is set automatically and expiresIn controls exp.
curl -X POST "https://api.apicodex.io/jwt/v1/sign?apikey=YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"payload":{"sub":"user_42"},"alg":"HS256","secret":"super-secret-value","expiresIn":"2h"}'POST /v1/verify
Verify a JWT signature and claims. Returns valid:true with payload+header on success, or valid:false with error+code (HTTP 200) for a bad, expired, or claim-mismatched token.
curl -X POST "https://api.apicodex.io/jwt/v1/verify?apikey=YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"token":"eyJhbGci...","secret":"super-secret-value","algorithms":["HS256"]}'GET /v1/decode
Decode a JWT WITHOUT verifying it. Returns the unverified header and payload plus a warning. Use only for inspection; never trust the data.
curl "https://api.apicodex.io/jwt/v1/decode?token=eyJhbGci...&apikey=YOUR_KEY"Sign Parameters
Required parameters
payloadCustom claims to embed as a JSON object. iat is set automatically.
Optional parameters
algSigning algorithm: HS256, HS384, HS512, RS256, ES256, or PS256. Defaults to HS256.secretShared secret. Required for HS* algorithms.privateKeyPEM-encoded PKCS8 private key. Required for RS*/ES*/PS* algorithms.expiresInDuration string (e.g. '2h', '30m', '7d') or seconds-from-now. Takes precedence over any exp in payload.issuerValue to set as the iss claim.audienceValue to set as the aud claim (string or array of strings).subjectValue to set as the sub claim.
Verify Parameters
Required parameters
tokenThe compact JWS to verify.
Optional parameters
secretShared secret. Required for HS* algorithms.publicKeyPEM-encoded SPKI public key. Required for RS*/ES*/PS* algorithms.algorithmsArray restricting accepted algorithms (defends against alg-confusion), e.g. ['HS256'].issuerExpected iss claim; verification fails on mismatch.audienceExpected aud claim (string or array); verification fails on mismatch.
Pricing
JWT API Pricing
One key, one subscription, all 49 APIs. Start free and upgrade when you grow. No minimums, no lock-in.
This API costs 1 credit per request. Credits are shared across every API on your plan.
Estimate your monthly cost
Drag the slider to match your expected request volume. We will recommend the cheapest plan that covers it.
Recommended plan
Starter
$29.99 /month
Free
- All 49 APIs included
- No credit card required
- Full documentation and examples
Starter
Popular- All 49 APIs included
- Email support
- Usage dashboard and analytics
Pro
- All 49 APIs included
- Priority support
- Up to 5 API keys
Need a different plan?
Tell us about your API, volume, or support requirements.
Coming soon · MCP
Use the JWT API from your AI agent
The API Codex MCP server will expose this API, and the other 39, to Claude, Cursor and any MCP client as tools. Same key, same credits, one config entry.
FAQ
Frequently asked questions
The API supports six algorithms across two families. The symmetric (shared-secret) algorithms are HS256, HS384, and HS512. The asymmetric (key-pair) algorithms are RS256, ES256, and PS256. HS256 is the default if you don't specify an alg. Symmetric algorithms require a secret; asymmetric algorithms require a PEM PKCS8 private key to sign and a PEM SPKI public key to verify.
/v1/verify performs full cryptographic validation: it checks the signature against your key material and enforces the exp/nbf time claims plus any issuer and audience you supply. /v1/decode does NOT verify anything — it simply Base64URL-decodes the header and payload so you can inspect them, and it returns an explicit warning. You should never trust decoded data for authorization; always run untrusted tokens through /v1/verify first.
Algorithm-confusion attacks trick a verifier into using an asymmetric public key as an HMAC secret by swapping the token header to a symmetric algorithm. To defend against this, pass the algorithms array on /v1/verify to pin exactly which algorithms you accept (e.g. ['ES256']). The API will reject any token whose algorithm isn't in your allowlist, so forged tokens fail verification outright.
A tampered, expired, or claim-mismatched token does not raise a 500 error. Instead /v1/verify returns HTTP 200 with a body like { "valid": false, "error": "signature verification failed", "code": "ERR_JWS_SIGNATURE_VERIFICATION_FAILED" }. This keeps client logic simple — you just branch on the valid boolean. A 400 is only returned for malformed requests, such as a missing token or invalid key material.
Use the expiresIn field on /v1/sign. It accepts a human-readable duration string such as '2h', '30m', or '7d', or a raw positive number of seconds from now. expiresIn takes precedence over any exp value you place in the payload. The iat (issued-at) claim is always added automatically when the token is signed.
Both are supported. Pass your key as the apikey query parameter (e.g. ?apikey=YOUR_KEY), or send it in an X-Api-Key header. You don't need to do anything extra in your request body either way.
Yes. The API runs on a global edge network of 300+ locations using native WebCrypto, with sub-10ms cold paths and a 99.9% uptime SLA. Because verification is stateless and self-contained, it adds negligible latency to request handling, making it well-suited for gateway and microservice authentication at scale. Paid tiers offer up to 200 requests per second and 5,000,000 requests per month.
Keep building