# JWT Decoder & Security Analyzer (`perryay/jwt-decoder-analyzer`) Actor Decode JWT tokens, verify HMAC/RSA/ECDSA/EdDSA signatures, detect alg=none bypass, key confusion, weak secrets, and expired tokens. Batch processing and audit report generation for DevSecOps teams. - **URL**: https://apify.com/perryay/jwt-decoder-analyzer.md - **Developed by:** [Perry AY](https://apify.com/perryay) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.02 / token decode This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## JWT Decoder & Security Analyzer 🔐 **Decode, verify, and security-audit JSON Web Tokens (JWTs) in seconds — decode header and payload, verify HMAC/RSA/ECDSA/EdDSA cryptographic signatures, and automatically detect critical vulnerabilities including algorithm none bypass, asymmetric key confusion, weak secrets, expired tokens, and missing standard claims — all in a single run.** --- ### What does it do? **JWT Decoder & Security Analyzer** is a comprehensive JSON Web Token inspection and security assessment tool built for DevSecOps engineers, penetration testers, API developers, and compliance teams. It goes far beyond basic base64url decoding by cryptographically verifying token signatures across 12+ algorithms — including HMAC (HS256/HS384/HS512), RSA (RS256/RS384/RS512), ECDSA (ES256/ES384/ES512), and EdDSA (Ed25519/Ed448) — and running an automated multi-check vulnerability scan that catches misconfigurations before attackers can exploit them. Unlike web-based JWT debuggers that expose sensitive tokens to third-party servers and offer no batch capabilities, this actor runs entirely server-side within your Apify pipeline, handles batch processing of up to 100 tokens in a single run, and produces structured, machine-readable security reports suitable for CI/CD gates, compliance documentation (SOC 2, ISO 27001), and penetration testing workflows. Every finding includes a CVSS-style severity weight, a human-readable description, and an actionable remediation recommendation — so you can fix issues immediately rather than hunting down documentation. The actor operates in two modes: **decode mode** (fast header-and-payload inspection with no security analysis) and **full mode** (comprehensive decode + vulnerability scan with signature verification). When processing multiple tokens with `generateReport` enabled, it produces a consolidated audit report that includes risk distribution summaries, algorithm usage discovery, valid-versus-invalid token counts, and per-token breakdowns — giving you a complete security posture snapshot of your entire JWT ecosystem. --- ### Who is it for? | Persona | What they use it for | |---------|---------------------| | **DevSecOps Engineers** | Integrate automated JWT validation into CI/CD pipelines; block deployments containing tokens with critical vulnerabilities | | **Penetration Testers** | Systematically test authentication endpoints for algorithm confusion, `alg=none` bypass, weak HMAC secrets, and signature verification flaws | | **API Developers** | Inspect token contents and verify signatures during local development without sending sensitive credentials to third-party websites | | **Security Auditors** | Generate audit-ready token security reports with CVSS-weighted findings for SOC 2, ISO 27001, PCI-DSS, and other compliance frameworks | | **Platform Engineering Teams** | Validate JWTs across microservice boundaries during key rotation events, provider migrations, or architecture changes | | **Identity Provider Administrators** | Batch-verify thousands of tokens during OIDC provider migrations, secret rotation events, or post-incident security reviews | --- ### Why use this? - **🔴 Catch critical vulnerabilities before attackers do** — Automatically detects `alg=none` signature bypass (CVSS 9.1), asymmetric key confusion attacks (CVSS 8.5), and weak HMAC secrets (CVSS 7.5) that are among the most commonly exploited JWT misconfigurations in production. - **🔐 Verify cryptographic signatures without third-party exposure** — Contrary to pasting tokens into jwt.io or similar web tools, this actor processes all tokens server-side within your Apify pipeline. No sensitive token data ever leaves your trusted execution environment. - **⚡ Batch-process up to 100 tokens per run** — Analyze an entire batch of tokens from a single input array, complete with a consolidated audit report showing risk distribution, algorithms found, and per-token breakdowns — perfect for key rotation events and mass migrations. - **📊 Get CVSS-weighted, actionable findings** — Every security finding includes a CVSS-style severity score, a plain-English description of the issue, and a concrete remediation recommendation. No vague alerts — you know exactly what to fix and how. - **🧩 Support for every major signing algorithm** — HMAC (HS256/HS384/HS512), RSA (RS256/RS384/RS512), ECDSA (ES256/ES384/ES512), and EdDSA (Ed25519/Ed448) are all fully supported for both decoding and cryptographic signature verification. - **📋 Generate compliance-ready audit reports** — Enable `generateReport` in batch mode to produce structured audit reports with risk distribution summaries, algorithm usage discovery, and per-token security breakdowns — ready for SOC 2, ISO 27001, and PCI-DSS compliance documentation. - **🛡ī¸ Detect missing security claims automatically** — The scanner flags tokens missing the `jti` (JWT ID) claim that helps prevent replay attacks and the `iss` (issuer) claim recommended for multi-service environments, ensuring your tokens follow OAuth 2.0 and OpenID Connect best practices. - **📈 Risk scoring with five severity levels** — Each token receives a composite risk score (SAFE, LOW, MEDIUM, HIGH, CRITICAL) and a numeric risk level (0–10) so you can prioritize remediation efforts across your entire token inventory. --- ### Features #### Token Decoding - Decode JWT header and payload from base64url encoding with structured JSON output - Handle all standard JWT compact serialization formats (3-part encoding) - Graceful error handling for malformed tokens — invalid base64, non-JSON payloads, unexpected part counts, and truncated inputs - Automatic detection and reporting of unsecured JWTs (2-part tokens with no signature) - Signature extraction as hexadecimal representation with byte-length reporting #### Cryptographic Signature Verification - **HMAC**: HS256 (SHA-256), HS384 (SHA-384), HS512 (SHA-512) — constant-time verification against a provided secret using `hmac.compare_digest` - **RSA**: RS256 (SHA-256), RS384 (SHA-384), RS512 (SHA-512) — PKCS1v15 signature verification against PEM-encoded RSA public keys via the `cryptography` library - **ECDSA**: ES256 (SHA-256, P-256), ES384 (SHA-384, P-384), ES512 (SHA-512, P-521) — ECDSA signature verification against PEM-encoded EC public keys - **EdDSA**: Ed25519 and Ed448 — full EdDSA verification against PEM-encoded Ed25519/Ed448 public keys - Support for both symmetric (HMAC secret) and asymmetric (PEM public key) verification workflows - Clear PASS/FAIL findings for every verification attempt with descriptive messages #### Security Vulnerability Scanner | Finding | Severity | CVSS | Description | |---------|----------|------|-------------| | `alg=none` Signature Bypass | 🔴 CRITICAL | 9.1 | Detects unsigned tokens using the `none` algorithm — a critical misconfiguration allowing arbitrary token forgery | | Asymmetric Key Confusion | 🔴 CRITICAL | 8.5 | Detects HMAC algorithm tokens being verified against PEM-formatted RSA/EC keys, a vector for key confusion attacks | | Weak HMAC Secret | 🟠 HIGH | 7.5 | Identifies HMAC secrets shorter than 16 characters or matching common/weak values (secret, key, password, 123456, admin, test) | | Invalid Signature — Tampered Token | 🟠 HIGH | 8.0 | Token signature verification failed — the token has been tampered with or the wrong key/secret was provided | | Empty or Malformed Signature | 🟠 HIGH | 7.0 | Token claims a non-`none` algorithm but has an empty or malformed signature block | | Signature Verification Error | 🟡 WARNING | 0.0 | Cryptographic library error during signature verification (key format mismatch, unsupported curve, etc.) | | Token Expired | ℹī¸ INFO | 0.0 | Token's `exp` claim is in the past; includes human-readable expiry time and minutes since expiration | | Token Nearing Expiry | ℹī¸ INFO | 0.0 | Token will expire within 60 minutes; includes remaining time and exact expiry timestamp | | Token Not Yet Valid (nbf) | ℹī¸ INFO | 0.0 | Token's `nbf` (not-before) claim is in the future; token is not yet usable | | Missing `jti` (JWT ID) | ℹī¸ INFO | 1.0 | Token lacks a unique identifier — adding `jti` helps prevent token replay attacks | | Missing `iss` (Issuer) | ℹī¸ INFO | 0.0 | Token does not specify an issuer — recommended for multi-service environments | #### Risk Scoring System - Composite numeric risk level from 0 (safe) to 10 (maximum risk) - Five severity categories: SAFE → LOW → MEDIUM → HIGH → CRITICAL - CVSS-inspired weighting: CRITICAL findings add 4 points, HIGH findings add 3 points - Risk score automatically computed from finding severity and count - Per-token risk assessment available in both single and batch modes #### Batch Processing - Process up to 100 tokens in a single run via the `tokens` input array - Per-token indexing with sequential processing - Automatic deduplication: tokens from both `token` and `tokens` fields are combined - Maximum input validation with clear error messages #### Audit Report Generation - Consolidated report with timestamp, total token count, and full results array - Risk distribution summary: critical, high, medium, low, and safe token counts - Algorithm usage discovery — lists all unique algorithms found across the batch - Valid vs. invalid token counts for format integrity assessment - Each token's full decode result and security analysis preserved in the report #### Mode Selection - **decode mode**: Fast decoding only — header and payload inspection without security analysis or signature verification - **full mode** (default): Comprehensive analysis — decode + full vulnerability scan + signature verification #### Token Integrity Checks - Validates JWT compact serialization format (expects exactly 3 dot-separated segments) - Detects unsecured tokens (2-part format without signature) - Reports invalid base64url encoding with specific error messages - Handles non-JSON payloads gracefully — returns raw string representation - Reports signature byte length for cryptographic strength assessment --- ### Input Parameters | Field | Type | Required | Default | Description | |-------|------|----------|---------|-------------| | `token` | string | No | — | A single JWT token to decode and analyze. Required if `tokens` is empty. | | `tokens` | array | No | `[]` | Array of JWT tokens for batch processing (maximum 100). When provided with `generateReport`, produces a consolidated audit report. | | `mode` | select | No | `full` | Analysis mode: `decode` (decode header and payload only) or `full` (decode + comprehensive security vulnerability scan with signature verification). | | `secretOrKey` | string | No | — | HMAC secret for HS256/HS384/HS512, or PEM-encoded RSA/EC/EdDSA public key for asymmetric algorithm verification. Omit to skip signature verification. | | `generateReport` | boolean | No | `false` | When `true` and processing multiple tokens, produces a consolidated audit report with risk distribution summary, algorithm usage discovery, and per-token breakdowns. | At least one token must be provided via `token` (single mode) or `tokens` (batch mode). If both are supplied, they are combined and processed together. --- ### Example Input #### Single Token Mode ```json { "mode": "full", "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "secretOrKey": "your-256-bit-secret-key-here-minimum-length", "generateReport": false } ```` #### Batch Mode (with Audit Report) ```json { "mode": "full", "tokens": [ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9.", "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ0ZXN0IiwiaWF0IjoxNTE2MjM5MDIyfQ.MEQCICpXHKPLjpPWRxQAHqDbP-4vEJNJX_d4h1lVLbmM1P4oAiA1vKNMVpB_ESDs_VnHESjAjeXHic_27I5htVyt0S22BA" ], "secretOrKey": "your-256-bit-secret-key-here", "generateReport": true } ``` *** ### Output Structure #### Single Token Output (field map) | Field | Type | Description | |-------|------|-------------| | `decoded.token` | string | Truncated JWT token (first 80 characters) | | `decoded.validFormat` | boolean | Whether the token has valid JWT compact serialization format | | `decoded.parts` | integer | Number of dot-separated parts (expected: 3) | | `decoded.header` | object | Decoded JWT header containing `alg`, `typ`, `kid`, etc. | | `decoded.payload` | object | Decoded JWT payload with all claims (sub, iss, exp, iat, etc.) | | `decoded.signature` | string | Signature as hexadecimal string | | `decoded.signatureBytes` | integer | Length of the signature in bytes | | `decoded.error` | string | Error message if token format is invalid | | `security.riskScore` | string | Overall risk category: SAFE, LOW, MEDIUM, HIGH, or CRITICAL | | `security.riskLevel` | integer | Numeric risk level from 0 (safe) to 10 (critical) | | `security.signatureValid` | boolean or null | Signature verification result (null when no key provided) | | `security.findings[]` | array | Array of security findings with type, title, description, CVSS score, and remediation | #### Batch Audit Report Output (field map) | Field | Type | Description | |-------|------|-------------| | `auditTimestamp` | string | ISO 8601 timestamp of when the audit was generated | | `totalTokens` | integer | Total number of tokens processed | | `summary.validTokens` | integer | Number of tokens with valid JWT format | | `summary.invalidTokens` | integer | Number of malformed or invalid tokens | | `summary.riskDistribution.critical` | integer | Count of tokens scored CRITICAL | | `summary.riskDistribution.high` | integer | Count of tokens scored HIGH | | `summary.riskDistribution.medium` | integer | Count of tokens scored MEDIUM | | `summary.riskDistribution.low` | integer | Count of tokens scored LOW | | `summary.riskDistribution.safe` | integer | Count of tokens scored SAFE | | `summary.algorithmsFound` | array | List of unique algorithms detected across the batch | | `tokens[]` | array | Array of per-token decode and security results (same structure as single mode) | *** ### Output Format #### Single Token — Full Mode Response ```json { "decoded": { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibm...", "validFormat": true, "parts": 3, "header": { "alg": "HS256", "typ": "JWT" }, "payload": { "sub": "1234567890", "name": "John Doe", "iat": 1516239022, "exp": 1716239022 }, "signature": "7348f2c7044948f1828513d84f1f0a4c789f7f8e8e93ac4957f5d41b2cc30e5c", "signatureBytes": 32 }, "security": { "riskScore": "SAFE", "riskLevel": 1, "signatureValid": true, "findings": [ { "type": "PASS", "title": "HMAC Signature Verified", "description": "Token signature verified successfully with provided secret.", "cvss": 0.0 }, { "type": "INFO", "title": "Missing jti (JWT ID)", "description": "The token does not contain a 'jti' claim. Adding a unique identifier helps prevent token replay attacks.", "cvss": 1.0, "remediation": "Include a 'jti' claim with a unique value (e.g., UUID)." } ] } } ``` #### Batch Mode — Audit Report Response ```json { "auditTimestamp": "2026-07-23T11:30:00.123456+00:00", "totalTokens": 3, "summary": { "validTokens": 3, "invalidTokens": 0, "riskDistribution": { "critical": 1, "high": 0, "medium": 0, "low": 0, "safe": 2 }, "algorithmsFound": [ "HS256", "none", "RS256" ] }, "tokens": [ { "index": 0, "decoded": { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "validFormat": true, "parts": 3, "header": { "alg": "HS256", "typ": "JWT" }, "payload": { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }, "signature": "7348f2c7044948f1828513d84f1f0a4c789f7f8e8e93ac4957f5d41b2cc30e5c", "signatureBytes": 32 }, "security": { "riskScore": "SAFE", "riskLevel": 1, "signatureValid": true, "findings": [ { "type": "PASS", "title": "HMAC Signature Verified", "cvss": 0.0 } ] } }, { "index": 1, "decoded": { "token": "eyJhbGciOiJub25lIn0...", "validFormat": true, "parts": 3, "header": { "alg": "none" }, "payload": { "sub": "admin", "role": "admin" }, "signature": "", "signatureBytes": 0 }, "security": { "riskScore": "CRITICAL", "riskLevel": 4, "signatureValid": null, "findings": [ { "type": "CRITICAL", "title": "alg=none (Signature Bypass)", "description": "The token uses alg='none', meaning the server accepts unsigned tokens. This is a critical vulnerability — an attacker can forge arbitrary tokens.", "cvss": 9.1, "remediation": "Configure the server to reject 'none' algorithm. Use a strict allowlist." } ] } }, { "index": 2, "decoded": { "token": "eyJhbGciOiJSUzI1NiJ9...", "validFormat": true, "parts": 3, "header": { "alg": "RS256" }, "payload": { "sub": "test", "iat": 1516239022 }, "signature": "304402201ca71ca3e3a4f0f464714007a83db3fef0bc449357f77887594b6e60d4cf4e28...", "signatureBytes": 71 }, "security": { "riskScore": "SAFE", "riskLevel": 0, "signatureValid": true, "findings": [ { "type": "PASS", "title": "RSA Signature Verified", "cvss": 0.0 } ] } } ] } ``` *** ### Use Cases - **CI/CD Security Gate** — Integrate JWT validation into your deployment pipeline to automatically block releases containing tokens with critical vulnerabilities (alg=none bypass, key confusion) or expired credentials. Each run produces structured output that can be parsed by your pipeline tooling to enforce security policies before code reaches production. - **Penetration Testing & Red Teaming** — Systematically test authentication endpoints for the OWASP JWT Cheat Sheet's top misconfigurations: algorithm confusion, alg=none acceptance, weak HMAC secrets, and improper signature verification. Batch-scan hundreds of collected tokens and prioritize exploitation based on the CVSS-weighted findings. - **Authentication Provider Migration** — When migrating from Auth0 to a custom OIDC provider, rotating HMAC secrets, or upgrading from RS256 to ES256, batch-verify existing tokens against the new infrastructure to ensure backward compatibility and zero downtime for your users. The audit report provides a complete inventory of algorithms and token validity. - **API Debugging & Development** — Inspect token contents and verify signatures during local API development without pasting sensitive credentials into third-party websites. The actor runs entirely within your Apify account, keeping authentication secrets and token payloads private. - **DevSecOps Compliance & Auditing** — Generate audit-ready token security reports for SOC 2, ISO 27001, PCI-DSS, and other compliance frameworks. The structured JSON output includes risk distribution summaries, CVSS-weighted findings with remediations, and per-token breakdowns — everything compliance auditors need to verify JWT security posture. - **Post-Incident Security Review** — After a suspected token-related security incident (breach, misconfiguration, or abuse), batch-analyze all active tokens in your system to identify compromised credentials, expired tokens that should have been rotated, and algorithm misconfigurations that may have been exploited. The risk distribution summary gives you an immediate picture of blast radius. - **OIDC Provider Validation** — When deploying OpenID Connect providers, validate that issued ID tokens and access tokens conform to expected algorithms, contain required claims (iss, exp, iat), and are properly signed. The scanner's missing-claims detection flags missing `jti` and `iss` claims — key OIDC Core specification requirements for token uniqueness and issuer identification. # Actor input Schema ## `mode` (type: `string`): Select the analysis mode: 'decode' (decode only), 'full' (decode + security analysis, recommended) ## `token` (type: `string`): A single JWT token to decode and analyze. Required if 'tokens' is empty. ## `tokens` (type: `array`): Array of JWT tokens for batch processing. When provided, generates an audit report with risk distribution. ## `secretOrKey` (type: `string`): HMAC secret (for HS256/HS384/HS512) or PEM-encoded public key (for RS256/RS384/RS512/ES256/ES384/ES512). Optional — omit to skip signature verification. ## `generateReport` (type: `boolean`): When true and processing multiple tokens, produces a consolidated audit report with risk distribution summary ## Actor input object example ```json { "mode": "full", "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "tokens": [ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ0ZXN0In0." ], "generateReport": false } ``` # Actor output Schema ## `results` (type: `string`): JWT analysis results in the default dataset — one item per token or a consolidated audit report in batch mode # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "tokens": [ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ0ZXN0In0." ], "secretOrKey": "" }; // Run the Actor and wait for it to finish const run = await client.actor("perryay/jwt-decoder-analyzer").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "tokens": [ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ0ZXN0In0.", ], "secretOrKey": "", } # Run the Actor and wait for it to finish run = client.actor("perryay/jwt-decoder-analyzer").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "tokens": [ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ0ZXN0In0." ], "secretOrKey": "" }' | apify call perryay/jwt-decoder-analyzer --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=perryay/jwt-decoder-analyzer", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "JWT Decoder & Security Analyzer", "description": "Decode JWT tokens, verify HMAC/RSA/ECDSA/EdDSA signatures, detect alg=none bypass, key confusion, weak secrets, and expired tokens. Batch processing and audit report generation for DevSecOps teams.", "version": "1.0", "x-build-id": "C2gTt8EzY7zdyIZY1" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/perryay~jwt-decoder-analyzer/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-perryay-jwt-decoder-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/perryay~jwt-decoder-analyzer/runs": { "post": { "operationId": "runs-sync-perryay-jwt-decoder-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/perryay~jwt-decoder-analyzer/run-sync": { "post": { "operationId": "run-sync-perryay-jwt-decoder-analyzer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "mode": { "title": "Analysis Mode", "enum": [ "decode", "full" ], "type": "string", "description": "Select the analysis mode: 'decode' (decode only), 'full' (decode + security analysis, recommended)", "default": "full" }, "token": { "title": "JWT Token", "type": "string", "description": "A single JWT token to decode and analyze. Required if 'tokens' is empty." }, "tokens": { "title": "Multiple Tokens (Batch Mode)", "type": "array", "description": "Array of JWT tokens for batch processing. When provided, generates an audit report with risk distribution.", "default": [] }, "secretOrKey": { "title": "Secret or Public Key (for Signature Verification)", "type": "string", "description": "HMAC secret (for HS256/HS384/HS512) or PEM-encoded public key (for RS256/RS384/RS512/ES256/ES384/ES512). Optional — omit to skip signature verification." }, "generateReport": { "title": "Generate Audit Report", "type": "boolean", "description": "When true and processing multiple tokens, produces a consolidated audit report with risk distribution summary", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```