Validate JWT

Overview

You pass a JWT; we enforce compact JWS structure, reject alg=none and disallowed algorithms, reject unprocessed crit headers fail-closed, validate exp/nbf/iat with configurable clock skew, check issuer and audience, and verify the signature (via Nimbus JOSE+JWT) when you supply JWK/PEM/HMAC key material — refusing asymmetric/HMAC key confusion. trusted=true only when the signature is verified AND required claims pass. We never fetch remote keys (jku/x5u). Do not use this for inspection-only decoding — use security.decode_jwt.

JWTs are easy to decode but dangerous to trust incorrectly — you need a skill that separates parsing, validation, and trust explicitly and fails closed.

When to use it

Scope

Non-goals

• Does not fetch remote keys (jku/x5u/JWKS URLs)
• Does not accept alg=none
• Does not process 'crit' critical headers — any 'crit' is rejected fail-closed
• Does not auto-select key type from the token header

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.validate_jwt","input":{"jwt":"eyJhbGciOiJIUzI1NiJ9..."}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.validate_jwt", {"jwt":"eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0."});

Errors

Other limits

Limitations

• Does not fetch remote keys (jku/x5u/JWKS URLs)
• Does not accept alg=none
• Does not process 'crit' critical headers — any 'crit' is rejected fail-closed
• Does not auto-select key type from the token header
• Discovering keys from the token itself
• Trusting a token without providing verification key material

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.validate_jwt",
  "input": {
    "jwt": "eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0."
  }
}

Examples

{
  "jwt": "eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0."
}

{
  "trusted": false,
  "claims": {
    "sub": "1"
  },
  "valid": false,
  "header": {
    "alg": "none"
  },
  "defects": [
    {
      "code": "ALG_NONE",
      "severity": "error",
      "message": "Unsecured JWT (alg=none) is rejected. Signed tokens only."
    },
    {
      "code": "MISSING_EXP",
      "severity": "error",
      "message": "Required 'exp' claim is missing."
    },
    {
      "code": "SIGNATURE_NOT_CHECKED",
      "severity": "info",
      "message": "No verification key provided; signature was not checked. trusted=false."
    }
  ],
  "signatureVerified": false
}

{
  "jwt": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc",
  "requireExpiration": false
}

{
  "trusted": false,
  "claims": {
    "sub": "1234"
  },
  "valid": true,
  "header": {
    "alg": "HS256"
  },
  "defects": [
    {
      "code": "SIGNATURE_NOT_CHECKED",
      "severity": "info",
      "message": "No verification key provided; signature was not checked. trusted=false."
    }
  ],
  "signatureVerified": false
}

Recommended use cases

• Verify a JWT against a known public key or HMAC secret
• Check token expiry, audience, and issuer in an auth flow

Avoid for

• Discovering keys from the token itself
• Trusting a token without providing verification key material

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags