JWT Token API
The JWT Token API provides comprehensive JWT token operations for authentication and authorization. Encode, decode, verify, and refresh tokens without implementing complex cryptographic logic - perfect for microservices, mobile apps, and API security. ## Unique Features - **Token Introspection**: RFC 7662 compliant endpoint for token validation - **Token Revocation**: Blacklist and track revoked…
JWT Token API endpoints
| Method | Endpoint | Description |
|---|---|---|
| Health | ||
| GET |
/api/metrics /api/metrics |
Get API usage metrics. Requires authentication with API key. Returns request counts by endpoint and error counts. |
| GET |
/ / |
Get API information and available endpoints |
| GET |
/health /health |
Check API health status and uptime |
| JWT Operations | ||
| GET |
/api/jwt/algorithms /api/jwt/algorithms |
Get list of all supported JWT signing algorithms |
| POST |
/api/jwt/encode /api/jwt/encode |
Create a new JWT token with the provided payload. Supports symmetric (HS256-HS512) and asymmetric (RS256-RS512, ES256-ES384) algorithms. |
| POST |
/api/jwt/decode /api/jwt/decode |
Decode a JWT token without verification. Returns the header, payload, and expiration status. Does not validate the signature. |
| POST |
/api/jwt/validate /api/jwt/validate |
Validate token claims without verifying the signature. Checks expiration, issuer, audience, subject, and custom claims. |
| GET |
/api/jwt/expiry /api/jwt/expiry |
Calculate token expiration timestamp from a duration value and unit. Useful for determining when a token will expire. |
| POST |
/api/jwt/verify /api/jwt/verify |
Verify and decode a JWT token using a secret or public key. Returns the payload if valid, or error details if verification fails. |
| POST |
/api/jwt/refresh /api/jwt/refresh |
Refresh a JWT token with a new expiration. Decodes the existing token, removes the old expiration, and creates a new token with the specified expiry. |
| Keys | ||
| POST |
/api/jwt/keys/jwk /api/jwt/keys/jwk |
Convert a PEM-encoded RSA public or private key to JSON Web Key (JWK) format. Useful for key distribution and JWKS endpoints. |
| GET |
/api/jwt/keys/jwks/{keySetId}/keys /api/jwt/keys/jwks/{keySetId}/keys |
List all keys in a specific JWKS key set. |
| POST |
/api/jwt/keys/jwks/{keySetId}/keys /api/jwt/keys/jwks/{keySetId}/keys |
Add a new key to an existing JWKS key set. Accepts a PEM public key or JWK object. |
| GET |
/api/jwt/keys/jwks /api/jwt/keys/jwks |
Get a list of all JWKS key sets. Requires authentication. Returns key set IDs, key counts, and timestamps. |
| GET |
/api/jwt/keys/jwks/{keySetId} /api/jwt/keys/jwks/{keySetId} |
Retrieve a specific JWKS by its key set ID. Used for public key distribution. |
| POST |
/api/jwt/keys/jwks /api/jwt/keys/jwks |
Create or update a JWKS (JSON Web Key Set) for an application. Accepts PEM public keys or JWK objects. |
| DELETE |
/api/jwt/keys/jwks/{keySetId}/keys/{keyId} /api/jwt/keys/jwks/{keySetId}/keys/{keyId} |
Remove a specific key from a JWKS key set by its key ID. |
| POST |
/api/jwt/keys/generate /api/jwt/keys/generate |
Generate a new RSA key pair for JWT signing. Returns public and private keys in PEM format. Supports key sizes from 1024 to 4096 bits. |
| Token Management | ||
| POST |
/api/jwt/revoke /api/jwt/revoke |
Revoke a JWT token for logout or security reasons. Once revoked, the token will no longer pass verification. Uses token ID (jti) or token hash for identification. |
| POST |
/api/jwt/introspect /api/jwt/introspect |
Check if a token is active according to RFC 7662. Returns active status, expiration, and payload if valid. |
| GET |
/api/jwt/revoked /api/jwt/revoked |
Get a list of all revoked tokens. Useful for auditing token revocations. |
JWT Token API pricing
| Plan | Price | Rate limit | Quotas |
|---|---|---|---|
| BASIC | Free | 500 / minute |
|
| PRO | $15 / month | 2000 / minute |
|
| ULTRA | $79 / month | 10000 / minute |
|
| MEGA | $199 / month | 50000 / minute |
|