English Français العربية

JWT Decoder API

Official registry Other

Decode JWT tokens — inspect header, payload, claims, expiry. x402 micropayment.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (sse)
Claude Code 
claude mcp add --transport sse jwt-decoder-api 'https://jwt-decoder.api.klymax402.com/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "jwt-decoder-api": {
            "type": "sse",
            "url": "https://jwt-decoder.api.klymax402.com/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. JWT Decoder API
  2. Quickstart -- MCP
  3. Quickstart -- HTTP (x402)
  4. Tools
  5. Example agent prompts
  6. Payment
  7. Part of klymax402
  8. License

JWT Decoder API

Decode and inspect JWT tokens without verification. Extracts header, payload, claims, expiry, and signature algorithm. Pay-per-call via x402 (USDC on Base L2) -- no API key, no signup, no rate-limit wall.

Part of the klymax402 marketplace -- 100 x402 micropayment APIs for AI agents, one wallet, USDC on Base.

Quickstart -- MCP

Add to your MCP client config (Claude Desktop, Cursor, ElizaOS, etc.):

{
  "mcpServers": {
    "jwt-decoder": {
      "url": "https://jwt-decoder.api.klymax402.com/mcp"
    }
  }
}

Quickstart -- HTTP (x402)

curl -X POST "https://jwt-decoder.api.klymax402.com/api/decode" \
  -H "Content-Type: application/json" \
  -d '{"token":"..."}'
# -> 402 Payment Required, with an x402 payment challenge in the response body

Any x402-aware client (@x402/fetch, x402-agent-tools, ATXP) handles the 402 -> sign -> retry cycle automatically.

Tools

ToolMethodPathPriceDescription
security_decode_jwtPOST/api/decode$0.003Decode a JWT token without signature verification
security_decode_jwt

Use this when you need to decode and inspect a JWT token without verifying its signature. Returns the full header, payload, and expiration status.

Parameters

NameTypeRequiredDescription
tokenstringyesThe JWT token to decode (format: header.payload.signature)

Example response:

{"header":{"alg":"RS256","typ":"JWT"},"payload":{"sub":"user123","exp":1720000000},"issuedAt":"2025-01-01T00:00:00Z","expiresAt":"2025-07-03T00:00:00Z","isExpired":false}

When to use: debugging authentication issues, inspecting token claims before API calls, or verifying token expiry. Use this BEFORE making authenticated requests to check if a token needs refreshing.

Not for: hashing data (use crypto_generate_hash), base64 encoding/decoding (use utility_encode_base64), password analysis (use security_check_password).

Example agent prompts

  • "Decode and inspect a JWT token without verifying its signature"

Payment

  • Protocol: x402 -- HTTP-native pay-per-call, no signup, no API key
  • Network: Base L2 (eip155:8453)
  • Asset: USDC
  • Facilitator: Coinbase CDP (primary), PayAI (fallback)
  • Also reachable via ATXP (OAuth-wrapped x402, RFC 9728 protected-resource metadata)

Part of klymax402

100 x402 micropayment APIs for AI agents -- one wallet, USDC on Base, zero signup.

License

MIT

Frequently asked questions

What is JWT Decoder API?

Decode JWT tokens — inspect header, payload, claims, expiry. x402 micropayment.

How do I install JWT Decoder API?

It runs as a remote server. In Claude Code: claude mcp add --transport sse jwt-decoder-api 'https://jwt-decoder.api.klymax402.com/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does JWT Decoder API need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is JWT Decoder API open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains JWT Decoder API?

It is published by Br0ski777. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.