JWT toolkit
Decode and verify a JWT in one pass - see the payload and check the signature.
$0.050
per call · one payment for the whole workflow
POST /api/skill/jwt-toolkit
3 tools run server-side in one request. You pay once, settle once, and get a single response - no orchestration, no per-step payments, and a partial-success envelope if any step fails. USDC over x402 on any supported chain.
When to use this pack
An agent debugging authentication needs to both decode a JWT (see claims, expiry, issuer) and verify the signature. Two operations that always go together, bundled into one payment.
Tools in this pack
All 3 run inside the single $0.050 call above. Each is also callable on its own if you only need one part.
- JWT decode POST /api/jwt-decode Decode a JWT without verification: header, payload, expiry status, and time remaining. (Decoding only - signatures are NOT verified.)
- JWT verify (HMAC) POST /api/jwt-verify Verify an HS256/384/512 JWT signature against a secret and check expiry. Returns valid + decoded payload. (HMAC algorithms only.)
- JWT sign POST /api/jwt-sign Mint a signed JSON Web Token (HMAC: HS256 default, HS384, HS512) from a payload + secret. Pairs with jwt-decode/jwt-verify to complete the trio. Deterministic - same payload, secret, and alg always produce the same token.
Workflow
- Call jwt-decode to extract the header (algorithm, type) and payload (claims, expiry) without verification.
- Call jwt-verify with the token and secret='test' to check whether the signature is valid.
- Call jwt-sign with the decoded claims and secret='test' to re-issue a fresh token - the round-trip you need when rotating a signing secret, reproducing a token in a test fixture, or confirming the decode captured every claim.
Call it directly
Any x402 client pays the 402 and gets the whole workflow back in one response:
npx agent402-client call jwt-toolkit {"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.xxx"}
Run it in Claude
claude mcp add agent402 -s user -- npx -y agent402-mcp@latest
Then paste this prompt into Claude:
Analyze this JWT using Agent402's jwt-toolkit skill pack: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.xxx. (1) Decode it to see the claims, (2) verify the signature with secret='test', (3) re-sign the claims with jwt-sign (secret='test'). Report the payload, verification result, and the re-issued token.