▣ DEVELOPER TOOLS · SECURITY & PRIVACY

Encode and Decode JWT API

What it does

JWT Tools lets you encode a JSON payload into a JWT and decode or verify an existing token with a shared secret. Send a payload and secret to /encode, or send a token and secret to /decode; both endpoints accept an optional algorithm field, with HS256 as the default.

Use JWT Tools when you need to issue signed tokens for sessions, API access, or short-lived claims, and when you need to check that an incoming token is valid before trusting its contents. The encode endpoint returns a token string.

The decode endpoint returns a valid boolean and a decoded payload object. That makes it useful for authentication flows, internal debugging, and any service that needs to inspect JWT claims without guessing at the signature logic.

If your application already stores claims as JSON, JWT Tools gives you a straightforward way to sign them and verify them with the same shared secret.

▣ ENDPOINT 01 / 02

POST

Sign a JSON payload into a JWT using HS256 or another algorithm

http://localhost:8080/dosvak/jwt-encode-decode/encode

QUICKSTARTGUIDE

Quickstart

Create a signed JWT by sending the required payload and secret fields.

curl -X POST "http://localhost:8080/dosvak/jwt-encode-decode/encode" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"payload":{"exp":9999999999,"sub":"user123"},"secret":"my-secret-key"}'

What you'll get back

Returns a JSON object with a token string field containing the encoded JWT.

{
  "token": "eyJhbGciOiJIUzI1NiJ9..."
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Signs a JSON payload into a JWT using the provided secret and returns the generated token. The request body includes the payload to encode, the signing secret, and an optional algorithm.

Request Body

Parameter	Type	Mandatory	Description
payload	Object	Yes	JSON payload to encode into the JWT.
secret	String	Yes	Secret key used to sign the token.
algorithm	String	No	Signing algorithm to use. Default: `HS256`.

Response

Returns a JSON object with a token string field containing the signed JWT.

Parameter	Type	Mandatory	Description
token	String	No	The generated JWT string.

Body

Name

Type

Description

bodyREQUIRED

object

—

▣ ENDPOINT 02 / 02

POST

Verify a JWT signature and return the decoded payload

http://localhost:8080/dosvak/jwt-encode-decode/decode

QUICKSTARTGUIDE

Quickstart

Decode a JWT by sending its token and secret in a JSON request body.

curl -X POST "http://localhost:8080/dosvak/jwt-encode-decode/decode" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIn0.signature","secret":"my-jwt-secret"}'

What you'll get back

Returns a JSON object with a valid boolean field and a payload object field. valid indicates whether the token could be decoded successfully, and payload contains the decoded JWT claims.

{
  "valid": true,
  "payload": {
    "sub": "user123"
  }
}

TRY ITLIVE · 10 ATOMS

API key

Loading your default key…

The full key is used to call the gateway and stays in this tab — never sent to orbit or saved.

About this endpoint

What it does

Verifies the signature of a JWT using the provided secret and returns whether the token is valid, along with the decoded payload object.

Request Body

Parameter	Type	Mandatory	Description
token	String	Yes	The JWT to verify and decode.
secret	String	Yes	The secret used to verify the JWT signature.
algorithm	String	No	The verification algorithm. Default: `HS256`.

Response

Returns a JSON object with a valid boolean field and a payload object field. valid indicates whether the JWT signature verification succeeded, and payload contains the decoded JWT payload.

Parameter	Type	Mandatory	Description
valid	Boolean	No	`true` when the JWT signature is valid, otherwise `false`.
payload	Object	No	The decoded JWT payload.

Body

Name

Type

Description

bodyREQUIRED

object

—

▣ COMMON ERRORS

Errors any endpoint can return

400bad_request

Required parameter missing or malformed body.

401unauthorized

API key missing, revoked, or not authorized for this service.

429rate_limited

Your plan's per-second rate exceeded. Retry with exponential backoff.

503upstream_busy

Backend temporarily unavailable. Try again in a few seconds.