Decode JWT

security.decode_jwt

ProductionBounded custom (Class B)Deterministicstrictinstantv1.0.0

No network

Overview

You pass a JWT compact serialization; we decode the header and payload from Base64URL into JSON objects. We do not verify the signature or validate any claim — trusted is always false with an explicit warning. We never fetch jku/x5u URLs. Do not use this for authorization decisions — use security.validate_jwt when trust is required.

You often need to inspect a JWT while debugging auth — without ever implying trust.

Reliability

STRICT and deterministic decode. trusted is always false by construction. Input validation (not retryable): missing jwt; jwt too long; malformed segments (unless allowTwoSegmentUnsecured is true for two-segment tokens).

Context footprint

Returns compact structured header/payload for LLM consumption. A successful call costs 1 execution credit.

When to use it

Debugging or inspecting a token's header and claims.

When a trust or authorization decision is required — use security.validate_jwt.

Scope

Note

Decodes JWT header/payload from Base64URL for inspection. Never verifies or trusts.

Non-goals

Does not verify the signature
Does not validate claims (exp, nbf, aud, iss)
Does not fetch jku/x5u/remote key URLs

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

analysisparsing

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input32 KB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response may contain submitted or transformed content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
jwt	string	Yes	Compact JWT serialization.
includeSignatureInfo	boolean	No	Whether signature metadata is returned; omit it for true.
allowTwoSegmentUnsecured	boolean	No	Whether unsecured two-segment input is accepted; omit it for false.

Output schema

Field	Type	Required	Description
decoded	boolean	Yes	Always true for a returned decode result.
trusted	boolean	Yes	Always false because no verification occurs.
header	object	Yes	Purpose-bound bounded JSON object copied untrusted from one JWT segment — unconstrained RFC 8259 JSON items.
payload	object	Yes	Purpose-bound bounded JSON object copied untrusted from one JWT segment — unconstrained RFC 8259 JSON items.
signaturePresent	boolean	No	Whether a non-empty signature segment exists.
signatureLengthBytes	integer	No	Decoded signature byte count.
warning	string	Yes	Fixed untrusted-output warning.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.decode_jwt","input":{"jwt":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.decode_jwt", {"jwt":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not verify the signature
Does not validate claims (exp, nbf, aud, iss)
Does not fetch jku/x5u/remote key URLs
Making any authorization or trust decision (use security.validate_jwt)

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "security.decode_jwt",
  "input": {
    "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc"
  }
}

Examples

Decode header and payload with signature metadata

Inputjson

{
  "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc"
}

Expected outputjson

{
  "signaturePresent": true,
  "trusted": false,
  "decoded": true,
  "signatureLengthBytes": 2,
  "warning": "Decoded JWT contents are UNTRUSTED. No signature was verified and no claims were validated. Do not make authorization decisions from this output.",
  "header": {
    "alg": "HS256"
  },
  "payload": {
    "sub": "1234"
  }
}

Omit signature metadata fields