Security & Secrets Tier 2 Ready POST /v1/jwt-jwk-inspector

JWT & JWK Security Auditor API — Detect alg:none, Weak Secrets, Header Injection & Exposed Private Keys

Audit JWT tokens and JWK sets against RFC 8725 for alg:none, weak secrets, and leaked keys. Stateless JWT, JWS, and JWK security linter that audits tokens and JWKS against RFC 8725 & RFC 7518: detects alg:none, jku/kid injection, weak HMAC secrets, and leaked private keys.

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/jwt-jwk-inspector`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "verdict": "fail",
    "security_score": 10,
    "grade": "F",
    "decoded_header": {
      "alg": "HS256",
      "typ": "JWT"
    },
    "decoded_payload": {
      "sub": "1234567890",
      "name": "John Doe",
      "iat": 1516239022
    },
    "signature_present": true,
    "signature_verified": true,
    "weak_secret_cracked": "your-256-bit-secret",
    "token_status": "missing_exp",
    "findings": [
      {
        "category": "weak_hmac_secret",
        "severity": "critical",
        "rfc_reference": "RFC 8725 §3.5",
        "description": "JWT is signed with a well-known weak secret ('your-256-bit-secret') and can be forged offline",
        "remediation": "Immediately rotate the HMAC signing key to at least 256 bits of CSPRNG entropy."
      },
      {
        "category": "claim_lifetime_hygiene",
        "severity": "high",
        "rfc_reference": "RFC 8725 §3.8",
        "description": "JWT payload omits the 'exp' (Expiration Time) claim, creating a non-expiring bearer token",
        "remediation": "Always include an 'exp' claim and enforce short access-token TTLs."
      },
      {
        "category": "claim_lifetime_hygiene",
        "severity": "low",
        "rfc_reference": "RFC 8725 §3.8–3.9",
        "description": "JWT omits standard scoping claims (iss, aud), weakening cross-service confused-deputy defenses",
        "remediation": "Include and validate 'iss' (issuer), 'aud' (audience), and 'sub' (subject) on every token."
      }
    ]
  },
  "meta": {
    "request_id": "req_jwt_01",
    "ms": 2
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/jwt-jwk-inspector" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/jwt-jwk-inspector", {
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/jwt-jwk-inspector",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/jwt-jwk-inspector", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_jwt_jwk_inspector",
    "arguments": {
      "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/jwt-jwk-inspector`)

Parameter	Type & Constraints	Description
`token`optional	`string` maxLen: 65536	Compact JWS / JWT string (header.payload.signature) to decode, verify, and audit against RFC 8725.
`hmac_secret`optional	`string` maxLen: 4096	Optional HMAC secret to verify HS256/HS384/HS512 signatures and check RFC 7518 key entropy requirements.
`jwk`optional	`object`	Optional JWK or JWKS ({ keys: [...] }) object to audit for leaked private key parameters (d, p, q, k) and key strength.
`reference_time_unix`optional	`integer` min: 0	Optional Unix epoch timestamp (seconds) for deterministic exp/nbf/iat validation.
`max_ttl_seconds`optional	`integer` min: 0, default: 86400	Maximum recommended token lifetime (exp - iat) in seconds before flagging long-lived access tokens.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`verdict`	`"pass" \| "warn" \| "fail"`	Field 'verdict'
`security_score`	`integer`	Field 'security_score'
`grade`	`"A" \| "B" \| "C" \| "D" \| "F"`	Field 'grade'
`decoded_header`	`object \| null`	Field 'decoded_header'
`decoded_payload`	`object \| null`	Field 'decoded_payload'
`signature_present`	`boolean`	Field 'signature_present'
`signature_verified`	`boolean \| null`	Field 'signature_verified'
`weak_secret_cracked`	`string \| null`	Field 'weak_secret_cracked'
`token_status`	`"valid_window" \| "expired" \| "not_yet_valid" \| "missing_exp" \| "not_provided"`	Field 'token_status'
`findings`	`object[]`	Field 'findings'

3. What JWT, JWS & JWK Security Auditor & RFC 8725 Linter API Detects & Validates

RFC 8725 header vulnerabilities: alg:none, missing signatures, untrusted jku/x5u/jwk headers, and SQLi/path-traversal characters in kid
Cryptographic verification of HS256/HS384/HS512 signatures via WebCrypto, RFC 7518 key-length checks, and offline cracking against common default JWT secrets
Claim hygiene: missing exp/iss/aud/sub, expired or future nbf timestamps, overly long token TTLs, and plaintext passwords/secrets in unencrypted JWS payloads
JWK / JWKS auditing: flags private RSA/EC/symmetric key parameters (d, p, q, dp, dq, qi, k) accidentally published in a public JWK set and RSA keys under 2048 bits

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Audits JWT/JWS structure, RFC 8725 rules, and HMAC/JWK properties deterministically (typically under 5 ms); does not fetch remote OIDC discovery URLs.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Does it check if a JWT is signed with a weak default secret even if I don't pass hmac_secret?

Yes, for HS256/HS384/HS512 tokens it automatically tests the signature against common weak default secrets ('secret', 'your-256-bit-secret', 'password', 'jwt_secret', etc.).

Why audit a public JWKS endpoint with this API?

Misconfigured auth servers occasionally serialize full keypairs into /.well-known/jwks.json. Passing your JWKS to POST /v1/jwt-jwk-inspector immediately flags any exposed private key parameters (d, p, q, k).

Are the tokens I send logged anywhere?

Never. Workers Observability and invocation logs are disabled, and all inspection happens in ephemeral isolate memory.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Tokens and JWK sets are inspected in memory and never logged or stored.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.