JWT

Sign, verify, and decode JSON Web Tokens.

Overview

JWT tool for creating, verifying, and decoding JSON Web Tokens. Supports HMAC (HS256/384/512), RSA (RS256/384/512), ECDSA (ES256/384/512), and RSA-PSS (PS256/384/512) algorithms. Sign creates a new token from claims, verify checks the signature and temporal claims, decode reads token contents without verification. All operations are local cryptographic computations with no external API calls.

Category: Development
Tool Name: jwt
Version: 1

Appearance: Icon: lucide-Shield | Color: #000000

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires JWT Credential credentials. See the Credentials Guide for setup instructions.

Operations

Operation	Value	Description
Decode	decode	Decode a JWT without verifying the signature
Sign	sign	Create a new signed JWT from claims
Verify	verify	Verify a JWT signature and decode its payload

Parameters

Decode (decode)

Parameter	Type	Required	Default	Description
Token	string	Yes	—	The JWT token to verify or decode. Supports expressions like {{ $json.token }}.

Sign (sign)

Parameter	Type	Required	Default	Description
Use JSON to Build Payload	boolean	No	false	Whether to use JSON to build the claims instead of structured fields.
Payload Claims	collection	No	{}	Standard JWT claims for the token payload. (shown when Use JSON to Build Payload is false)
— Audience	string	No	—	Identifies the recipients that the JWT is intended for.
— Expires In	number	No	3600	The lifetime of the token in seconds.
— Issuer	string	No	—	Identifies the principal that issued the JWT.
— JWT ID	string	No	—	Unique identifier for the JWT.
— Not Before	number	No	0	The time in seconds before which the JWT must not be accepted for processing.
— Subject	string	No	—	Identifies the principal that is the subject of the JWT.
Payload Claims (JSON)	json	No	{\n "my_field_1": "value 1",\n "my_field_2": "value 2"\n}\n	Claims to add to the token in JSON format. Allows custom claims beyond the standard set. (shown when Use JSON to Build Payload is true)

Verify (verify)

Parameter	Type	Required	Default	Description
Token	string	Yes	—	The JWT token to verify or decode. Supports expressions like {{ $json.token }}.

All Operations

Parameter	Type	Required	Default	Description
Options	collection	No	{}	Additional options for the JWT operation.
— Return Additional Info	boolean	No	false	Whether to return the complete decoded token with header, payload, and signature, or just the payload. (shown when Operation is verify, decode)
— Ignore Expiration	boolean	No	false	Whether to ignore the expiration of the token. (shown when Operation is verify)
— Ignore Not Before Claim	boolean	No	false	Whether to ignore the not before claim of the token. (shown when Operation is verify)
— Clock Tolerance	number	No	0	Number of seconds to tolerate when checking the nbf and exp claims, to deal with small clock differences among different servers. (shown when Operation is verify)
— Key ID	string	No	—	The kid (key ID) claim is an optional header claim, used to specify the key for validating the signature. (shown when Operation is sign)
— Override Algorithm	options	No	HS256	The algorithm to use for signing or verifying the token. Overrides the algorithm configured in credentials. (shown when Operation is sign, verify)
				Options: ES256, ES384, ES512, HS256, HS384, HS512, PS256, PS384, PS512, RS256, RS384, RS512
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

One output item per input item — no operation fans out. The result is merged onto the input item JSON: the fields that were already on the item pass through, and the node adds its own on top. Binary data is forwarded unchanged.

Operation	What lands on the item
sign	token — the signed JWT string
verify	payload — the verified claims, or (with Return Additional Info on) the decoded token spread onto the item as header, payload and signature
decode	payload — the claims read without signature verification, or (with Return Additional Info on) header, payload and signature

When you sign with structured claims rather than JSON, the fields map onto the standard registered claim names: Audience becomes aud, Issuer becomes iss, Subject becomes sub, and JWT ID becomes jti. Expires In and Not Before are applied as signing options, so they surface in the token as exp and nbf. Use Payload Claims (JSON) when you need custom claims beyond that set.

Reference the result downstream by expression, e.g. {{ $json.token }} or {{ $json.payload.sub }}.

Usage Examples

• Sign a JWT with custom claims and HS256 algorithm
• Verify a JWT token and extract its payload
• Decode a JWT without signature verification to inspect its contents
• Create a JWT with RS256 using a PEM private key
• Verify a JWT with expiration tolerance for clock skew

Example Configuration

Sign a token from the structured claim fields:

{
  "type": "jwt",
  "parameters": {
    "operation": "sign",
    "useJson": false,
    "claims": {
      "audience": "my-app",
      "issuer": "auth-service",
      "subject": "{{ $json.userId }}",
      "expiresIn": 3600
    },
    "options": {
      "algorithm": "HS256"
    }
  }
}

Sign a token with custom claims supplied as JSON:

{
  "type": "jwt",
  "parameters": {
    "operation": "sign",
    "useJson": true,
    "claimsJson": "{\n  \"sub\": \"{{ $json.userId }}\",\n  \"aud\": \"my-app\",\n  \"permissions\": [\"read\", \"write\"]\n}",
    "options": {
      "algorithm": "RS256",
      "kid": "signing-key-1"
    }
  }
}

Verify an incoming token, tolerating a few seconds of clock skew:

{
  "type": "jwt",
  "parameters": {
    "operation": "verify",
    "token": "{{ $json.token }}",
    "options": {
      "ignoreExpiration": false,
      "clockTolerance": 5
    }
  }
}

Decode a token without verifying it, returning the header as well:

{
  "type": "jwt",
  "parameters": {
    "operation": "decode",
    "token": "{{ $json.incomingToken }}",
    "options": {
      "complete": true
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Sign, verify, or decode JSON Web Tokens using HMAC or RSA/EC key pairs — use for authentication token creation, validation, and inspection.