6 min read · Last updated: 30 June 2025
Structure of a JWT
A JSON Web Token has three Base64URL segments: header, payload, and signature. The header declares the signing algorithm. The payload contains claims such as subject, audience, and expiration. The signature proves integrity when you verify with the correct secret or public key.
Claims to inspect first
Check exp and nbf for time validity, aud and iss for issuer configuration, and custom scopes or roles your API expects. A token may decode correctly yet fail authorization because a role claim is missing. Client-side decoding helps separate format problems from business rule failures.
Verifying signatures locally
HS256 tokens require the shared secret used by the issuer. RS256 tokens require the public key matching the private key that signed the token. Verification in drawflow.io runs in your browser so secrets are not uploaded. Prefer staging tokens when demonstrating verification flows.
Common failure patterns
Clock skew causes valid tokens to appear expired. Algorithm mismatch happens when a service expects RS256 but receives HS256. Tampered payloads fail verification even if JSON still decodes. Rotate keys deliberately and update all consumers before retiring old public keys.