note | string | Reminder that this endpoint only decodes and clock-checks; it does not cryptographically verify signatures. |
type | string | Token type from the header's typ field, typically JWT but sometimes at+jwt or similar variants. |
claims | object | Standard JWT claims extracted from payload: iss, aud, sub, jti, iat, exp, nbf with parsed timestamps. |
header | object | Decoded JWT header object with parsed JOSE fields like alg, typ, kid, and any custom header parameters. |
key_id | string | Key identifier from the header's kid field, used by verifiers to select the right signing key. |
payload | object | Decoded JWT payload object with all claims parsed from the base64url-decoded middle segment. |
algorithm | string | Signing algorithm declared in the header's alg field, such as HS256, RS256, ES256, or none. |
signature | string | Raw signature segment from the JWT as a base64url string; not verified by this endpoint. |
is_expired | boolean | True if exp claim is present and the expiration timestamp is in the past relative to server clock. |
is_not_yet_valid | boolean | True if nbf claim is present and the not-before timestamp is in the future relative to server clock. |
payload_size_bytes | number | Byte length of the decoded payload JSON, useful for spotting oversized tokens. |
is_currently_valid_by_clock | boolean | True if the token is neither expired nor not-yet-valid by clock; signature validity is not checked. |