{"inputSchema":{"type":"object","required":["token"],"additionalProperties":false,"properties":{"token":{"type":"string","minLength":10,"maxLength":20000,"description":"The JWT in compact form."},"secret":{"type":"string","maxLength":2000,"description":"Shared secret for HS256/384/512."},"public_key_pem":{"type":"string","maxLength":8000,"description":"PEM public key for RS/PS/ES algorithms."},"jwks_url":{"type":"string","maxLength":2000,"description":"JWKS endpoint; the key is picked by kid."},"expected_issuer":{"type":"string","maxLength":500,"description":"Issuer the token must carry."},"expected_audience":{"type":"string","maxLength":500,"description":"Audience the token must name."},"clock_skew_seconds":{"type":"integer","minimum":0,"maximum":3600,"default":60,"description":"Tolerance for exp and nbf."},"max_lifetime_seconds":{"type":"integer","minimum":1,"description":"Flag tokens valid for longer than this."}}},"requestExample":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuaW52YWxpZC9oYWxvd2Vyay1zeW50aGV0aWMiLCJzdWIiOiJzeW50aGV0aWMtZXhhbXBsZSIsImF1ZCI6InN5bnRoZXRpYy1leGFtcGxlIiwiaWF0Ijo5NDY2ODQ4MDAsImV4cCI6OTQ2Njg4NDAwfQ.RyBcYWZR8Bd7xTj_QqASWo1SGVw16vZR2EhIG6tAjiw","secret":"HALOWERK-public-synthetic-example-never-use-for-authentication","expected_issuer":"https://example.invalid/halowerk-synthetic","expected_audience":"synthetic-example"},"price_usdc":"0.002","example_request":{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2V4YW1wbGUuaW52YWxpZC9oYWxvd2Vyay1zeW50aGV0aWMiLCJzdWIiOiJzeW50aGV0aWMtZXhhbXBsZSIsImF1ZCI6InN5bnRoZXRpYy1leGFtcGxlIiwiaWF0Ijo5NDY2ODQ4MDAsImV4cCI6OTQ2Njg4NDAwfQ.RyBcYWZR8Bd7xTj_QqASWo1SGVw16vZR2EhIG6tAjiw","secret":"HALOWERK-public-synthetic-example-never-use-for-authentication","expected_issuer":"https://example.invalid/halowerk-synthetic","expected_audience":"synthetic-example"},"serviceName":"HALOWERK sicherwerk","tags":["security","jwt","tokens","auth"],"outputSchema":{"type":"object"},"outputExample":{"valid":false,"verdict":"invalid","signature":{"algorithm":"HS256","checked":true,"valid":true,"key_source":"secret","kid":null},"header":{"alg":"HS256","typ":"JWT"},"claims":{"iss":"https://example.invalid/halowerk-synthetic","sub":"synthetic-example","aud":"synthetic-example","iat":946684800,"exp":946688400},"timing":{"now":1792712496,"issued_at":946684800,"not_before":null,"expires_at":946688400,"expires_in_seconds":-846024096,"lifetime_seconds":3600,"clock_skew_allowed":60},"identity":{"issuer":"https://example.invalid/halowerk-synthetic","subject":"synthetic-example","audience":"synthetic-example","jwt_id":null,"scopes":null},"findings":[{"severity":"error","code":"expired","message":"Abgelaufen seit 14100402 Minuten."}],"counts":{"error":1,"warning":0,"info":0},"checked_at":"2026-10-22T23:41:36.994Z","limits":"Es wird geprueft, was im Token steht und ob die Signatur passt. Ob der Aussteller vertrauenswuerdig ist, ob das Token widerrufen wurde und ob der Betreff noch Rechte hat, steht hier nicht — dafuer braucht es den ausstellenden Dienst. Ohne Schluessel oder Geheimnis bleibt die Signatur ungeprueft, und die Angaben sind dann blosse Behauptungen."}}