JWT

Decode a JWT (no signature check)

POSThttps://ecdsa.com/api/v1/jwt/decode

Decodes a compact JWS token: header, payload, enriched exp/iat/nbf time claims and a classification of the algorithm. The signature is NOT verified — the response carries verified: false explicitly. Use /v1/jwt/verify to check ES* signatures.

Clé d’API: Facultative ; une clé doit avoir le scope api
Coût en quota avec une clé: 1 unité par appel
Limite de requêtes: 60 requêtes/min par IP

Requête

Corps JSON : JwtDecodeRequest

Champ	Type	Obligatoire	Description
token	string	oui	Compact JWS token. A leading "Bearer " and whitespace are stripped.

Réponses

200The decoded token (signature not verified).

Champ	Type	Obligatoire	Description
header	object	oui	noms de membres libres
payload	object	oui	noms de membres libres
signaturePresent	boolean	oui
signatureBytes	integer	oui	au moins 0
timeClaims	object	oui
timeClaims.exp	TimeClaim	oui
timeClaims.iat	TimeClaim	oui
timeClaims.nbf	TimeClaim	oui
timeClaims.status	object \| null	oui	null when the token carries no usable exp or nbf.
timeClaims.status.kind	string	oui	au choix : "expired", "not-yet-valid" ou "valid"
timeClaims.status.detail	string	oui
algInfo	AlgInfo	oui
verified	boolean	oui	Always false — this operation never verifies. toujours false
note	string	oui

En-têtes : X-Request-Id · X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Quota-Limit · X-Quota-Remaining · X-Quota-Reset

Statut	Signification	Codes
400	Bad request. Input limits: a request body of at most 100 KB (a larger one is answered with 413) and arrays and objects nested at most 64 levels deep, JSON documents inside string fields included.	invalid_json missing_field invalid_input private_key_rejected
401	Unauthorized.	unauthorized
403	Forbidden.	forbidden_scope
404	Not found.	not_found
405	Method not allowed.	method_not_allowed
413	Payload too large.	payload_too_large
429	Too many requests.	rate_limited quota_exceeded
500	Internal server error.	internal_error
503	Service unavailable.	service_unavailable
504	Gateway timeout.	timeout

Chaque réponse d’erreur porte l’enveloppe JSON ; le tableau des erreurs indique ce que signifie chaque code et que faire.

Exemple

An ES256 token

curl

curl -sS 'https://ecdsa.com/api/v1/jwt/decode' \
  -H 'content-type: application/json' \
  -d '{
  "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImNvcHBlci1leGFtcGxlLTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLmNvbSIsInN1YiI6InVzZXJfNDIiLCJhdWQiOiJlY2RzYSIsImlhdCI6MTc4NzE0MDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.fQpTQxkahGRlZp-U71-xNk68mpZH23dhn9QoysMLmZfBx_e-vd9sCgh7sJ4eXu0-WbQSNqzmVPyUKErCJx4DHw"
}'

JavaScript (fetch)

const response = await fetch("https://ecdsa.com/api/v1/jwt/decode", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImNvcHBlci1leGFtcGxlLTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLmNvbSIsInN1YiI6InVzZXJfNDIiLCJhdWQiOiJlY2RzYSIsImlhdCI6MTc4NzE0MDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.fQpTQxkahGRlZp-U71-xNk68mpZH23dhn9QoysMLmZfBx_e-vd9sCgh7sJ4eXu0-WbQSNqzmVPyUKErCJx4DHw"
  }),
});
console.log(response.status, await response.json());

Python (httpx)

import httpx

response = httpx.post(
    "https://ecdsa.com/api/v1/jwt/decode",
    json={
        "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImNvcHBlci1leGFtcGxlLTEifQ.eyJpc3MiOiJodHRwczovL2lzc3Vlci5leGFtcGxlLmNvbSIsInN1YiI6InVzZXJfNDIiLCJhdWQiOiJlY2RzYSIsImlhdCI6MTc4NzE0MDgwMCwiZXhwIjo0MDcwOTA4ODAwfQ.fQpTQxkahGRlZp-U71-xNk68mpZH23dhn9QoysMLmZfBx_e-vd9sCgh7sJ4eXu0-WbQSNqzmVPyUKErCJx4DHw",
    },
    timeout=30.0,
)
print(response.status_code, response.json())

Réponse 200

{
  "header": {
    "alg": "ES256",
    "typ": "JWT",
    "kid": "copper-example-1"
  },
  "payload": {
    "iss": "https://issuer.example.com",
    "sub": "user_42",
    "aud": "ecdsa",
    "iat": 1787140800,
    "exp": 4070908800
  },
  "signaturePresent": true,
  "signatureBytes": 64,
  "timeClaims": {
    "exp": {
      "value": 4070908800,
      "utc": "2099-01-01 00:00:00 UTC",
      "relative": "in 72 years"
    },
    "iat": {
      "value": 1787140800,
      "utc": "2026-08-19 12:00:00 UTC",
      "relative": "61 days ago"
    },
    "nbf": null,
    "status": {
      "kind": "valid",
      "detail": "valid until 2099-01-01 00:00:00 UTC (in 72 years)"
    }
  },
  "algInfo": {
    "alg": "ES256",
    "kind": "ecdsa",
    "curve": "P-256",
    "hash": "SHA-256",
    "signatureBytes": 64,
    "verifiableHere": true,
    "summary": "ES256 is ECDSA on P-256 with SHA-256; the JWS signature is raw r‖s (64 bytes). POST /api/v1/jwt/verify can check it."
  },
  "verified": false,
  "note": "This endpoint decodes the token without checking the signature. Use POST /api/v1/jwt/verify (ES256/ES384/ES512) to verify it against a public key."
}

La réponse de l’API à cet exemple, générée pour cette page le 20 octobre 2026 ; les temps relatifs et les nombres de jours qu’elle contient se rapportent à ce jour-là.

Codes d’erreur

Code	Statut	Signification
invalid_json	400	The body is not valid JSON or not a JSON object; or the input nests arrays and objects more than 64 levels deep (JSON documents inside string fields count too), or is too complex to inspect for private keys.
missing_field	400	A required field is absent or empty.
invalid_input	400	A field could not be parsed — the message explains exactly why.
private_key_rejected	400	The request contains private-key material (a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY private key, or a JWK with "d"). Never send private keys anywhere.
unauthorized	401	The Authorization or X-API-Key header is malformed, the API key is not valid (wrong checksum, unknown, revoked or expired), or the operation needs a key.
forbidden_scope	403	The API key is valid but lacks a scope this operation requires; the message names it.
not_found	404	No operation exists at this path.
method_not_allowed	405	The path exists but does not accept this HTTP method; see the Allow header.
payload_too_large	413	The body exceeds 100 KB.
rate_limited	429	Too many requests — see Retry-After.
quota_exceeded	429	A daily or monthly quota of the API key's account is used up. X-Quota-Reset (and Retry-After) say when it starts over; retrying earlier cannot succeed.
internal_error	500	Unexpected server error.
service_unavailable	503	API keys cannot be verified right now (the key store is unreachable); retry shortly.
timeout	504	The operation did not finish within its time budget.

Schémas

TimeClaim

null when the claim is absent; {error} when it is malformed.

Champ	Type	Obligatoire	Description
Variante 1value	number	oui	Seconds since the epoch.
Variante 1utc	string	oui
Variante 1relative	string	oui	For example "in 72 years" or "3 minutes ago".
Variante 2error	string	oui

AlgInfo

Classification of the header's alg value.

Champ	Type	Obligatoire	Description
alg	string \| null	oui
kind	string	oui	au choix : "ecdsa", "none", "hmac", "rsa", "eddsa", "missing" ou "unknown"
curve	string	non	au choix : "P-256", "P-384", "P-521" ou "secp256k1"
hash	string	non	au choix : "SHA-256", "SHA-384" ou "SHA-512"
signatureBytes	integer	non	au moins 0
verifiableHere	boolean	oui	Whether POST /v1/jwt/verify can check this token.
summary	string	oui

Error

The error envelope of every non-2xx response.

Champ	Type	Obligatoire	Description
error	object	oui
error.code	string	oui	Machine-readable error code. Each response lists the codes it can carry; new codes may be added within v1, so treat an unknown code by its HTTP status.
error.message	string	oui	Human-readable explanation (English).
error.requestId	string	non	The X-Request-Id of this request — quote it when reporting a problem. Sent since v1.1.
error.detail	object	non	Structured context for the error, such as the offending field; omitted when there is none. noms de membres libres
error.docs	string	non	Where the error codes are explained. Sent since v1.1. format uri

Toutes les opérations sont répertoriées dans la référence de l’API.