<!-- BusyBot node reference — https://busybot.net/tools/jwt/ -->

> Node: JWT (`jwt`) · Action · v1
> Category: Development · Credentials: JWT Credential (`jwtApi`)
> Updated: 2026-08-16

# JWT

> Sign, verify, and decode JSON Web Tokens.

## Overview

JWT tool for creating, verifying, and decoding JSON Web Tokens. Supports HMAC (HS256/384/512), RSA (RS256/384/512), ECDSA (ES256/384/512), and RSA-PSS (PS256/384/512) algorithms. Sign creates a new token from claims, verify checks the signature and temporal claims, decode reads token contents without verification. All operations are local cryptographic computations with no external API calls.

**Category:** Development  
**Tool Name:** `jwt`  
**Version:** 1

**Appearance:** Icon: `lucide-Shield` | Color: `#000000`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **JWT Credential** credentials.
See the [Credentials Guide](https://busybot.net/credentials/jwt-api/) for setup instructions.

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Decode | `decode` | Decode a JWT without verifying the signature |
| Sign | `sign` | Create a new signed JWT from claims |
| Verify | `verify` | Verify a JWT signature and decode its payload |

### Parameters

#### Decode (`decode`)

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Token | `string` | Yes | — | The JWT token to verify or decode. Supports expressions like {{ $json.token }}. |

#### Sign (`sign`)

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Use JSON to Build Payload | `boolean` | No | `false` | Whether to use JSON to build the claims instead of structured fields. |
| Payload Claims | `collection` | No | `{}` | Standard JWT claims for the token payload. _(shown when Use JSON to Build Payload is `false`)_ |
| — Audience | `string` | No | — | Identifies the recipients that the JWT is intended for. |
| — Expires In | `number` | No | `3600` | The lifetime of the token in seconds. |
| — Issuer | `string` | No | — | Identifies the principal that issued the JWT. |
| — JWT ID | `string` | No | — | Unique identifier for the JWT. |
| — Not Before | `number` | No | `0` | The time in seconds before which the JWT must not be accepted for processing. |
| — Subject | `string` | No | — | Identifies the principal that is the subject of the JWT. |
| Payload Claims (JSON) | `json` | No | `{\n  "my_field_1": "value 1",\n  "my_field_2": "value 2"\n}\n` | Claims to add to the token in JSON format. Allows custom claims beyond the standard set. _(shown when Use JSON to Build Payload is `true`)_ |

#### Verify (`verify`)

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Token | `string` | Yes | — | The JWT token to verify or decode. Supports expressions like {{ $json.token }}. |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Options | `collection` | No | `{}` | Additional options for the JWT operation. |
| — Return Additional Info | `boolean` | No | `false` | Whether to return the complete decoded token with header, payload, and signature, or just the payload. _(shown when Operation is `verify`, `decode`)_ |
| — Ignore Expiration | `boolean` | No | `false` | Whether to ignore the expiration of the token. _(shown when Operation is `verify`)_ |
| — Ignore Not Before Claim | `boolean` | No | `false` | Whether to ignore the not before claim of the token. _(shown when Operation is `verify`)_ |
| — Clock Tolerance | `number` | No | `0` | Number of seconds to tolerate when checking the nbf and exp claims, to deal with small clock differences among different servers. _(shown when Operation is `verify`)_ |
| — Key ID | `string` | No | — | The kid (key ID) claim is an optional header claim, used to specify the key for validating the signature. _(shown when Operation is `sign`)_ |
| — Override Algorithm | `options` | No | `HS256` | The algorithm to use for signing or verifying the token. Overrides the algorithm configured in credentials. _(shown when Operation is `sign`, `verify`)_ |
| | | | | Options: `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`, `PS256`, `PS384`, `PS512`, `RS256`, `RS384`, `RS512` |
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

One output item per input item — no operation fans out. The result is **merged onto the input item JSON**: the fields that were already on the item pass through, and the node adds its own on top. Binary data is forwarded unchanged.

| Operation | What lands on the item |
|-----------|------------------------|
| `sign` | `token` — the signed JWT string |
| `verify` | `payload` — the verified claims, or (with Return Additional Info on) the decoded token spread onto the item as `header`, `payload` and `signature` |
| `decode` | `payload` — the claims read without signature verification, or (with Return Additional Info on) `header`, `payload` and `signature` |

When you sign with structured claims rather than JSON, the fields map onto the standard registered claim names: Audience becomes `aud`, Issuer becomes `iss`, Subject becomes `sub`, and JWT ID becomes `jti`. Expires In and Not Before are applied as signing options, so they surface in the token as `exp` and `nbf`. Use Payload Claims (JSON) when you need custom claims beyond that set.

Reference the result downstream by expression, e.g. `{{ $json.token }}` or `{{ $json.payload.sub }}`.

## Usage Examples

- Sign a JWT with custom claims and HS256 algorithm
- Verify a JWT token and extract its payload
- Decode a JWT without signature verification to inspect its contents
- Create a JWT with RS256 using a PEM private key
- Verify a JWT with expiration tolerance for clock skew

## Example Configuration

Sign a token from the structured claim fields:

```json
{
  "type": "jwt",
  "parameters": {
    "operation": "sign",
    "useJson": false,
    "claims": {
      "audience": "my-app",
      "issuer": "auth-service",
      "subject": "{{ $json.userId }}",
      "expiresIn": 3600
    },
    "options": {
      "algorithm": "HS256"
    }
  }
}
```

Sign a token with custom claims supplied as JSON:

```json
{
  "type": "jwt",
  "parameters": {
    "operation": "sign",
    "useJson": true,
    "claimsJson": "{\n  \"sub\": \"{{ $json.userId }}\",\n  \"aud\": \"my-app\",\n  \"permissions\": [\"read\", \"write\"]\n}",
    "options": {
      "algorithm": "RS256",
      "kid": "signing-key-1"
    }
  }
}
```

Verify an incoming token, tolerating a few seconds of clock skew:

```json
{
  "type": "jwt",
  "parameters": {
    "operation": "verify",
    "token": "{{ $json.token }}",
    "options": {
      "ignoreExpiration": false,
      "clockTolerance": 5
    }
  }
}
```

Decode a token without verifying it, returning the header as well:

```json
{
  "type": "jwt",
  "parameters": {
    "operation": "decode",
    "token": "{{ $json.incomingToken }}",
    "options": {
      "complete": true
    }
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Sign, verify, or decode JSON Web Tokens using HMAC or RSA/EC key pairs -- use for authentication token creation, validation, and inspection.