API Reference

Integrate JWT security scanning directly into your CI/CD pipeline, auth middleware, or security toolchain.

Overview

The avsig API lets you programmatically decode and audit JSON Web Tokens. Send a JWT, get back a full security report - decoded claims, expiry status, and results of 8 automated security checks with a trust score.

All endpoints return JSON. Authentication is via API key passed in the X-API-Key header.

Authentication

Pass your API key in the X-API-Key header on every request. Alternatively use the Authorization: Bearer <key> header.

POST /api/v1/inspect
X-API-Key: avsig_your_key_here
Content-Type: application/json

POST /inspect

Decodes and audits a JWT token. Returns decoded claims, expiry info, trust score, and all security check results.

Request body

Example request

curl -X POST https://avsig.vercel.app/api/v1/inspect \
  -H "Content-Type: application/json" \
  -H "X-API-Key: avsig_your_key_here" \
  -d '{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"}'

Response schema

{
  "success": true,
  "meta": {
    "plan": "free",
    "scanned_at": "2026-04-12T16:18:39.262Z",
    "docs": "https://avsig.vercel.app/docs"
  },
  "data": {
    "header": {
      "alg": "HS256",
      "typ": "JWT"
    },
    "payload": {
      "sub": "1234567890",
      "name": "sadiq salodgi",
      "iat": 1516239022
    },
    "expiry": {
      "status": "none",
      "message": "No expiry set"
    },
    "summary": {
      "total": 8,
      "passed": 6,
      "failed": 2,
      "critical": 0,
      "warnings": 2,
      "risk": "medium"
    },
    "checks": [
      {
        "id": "alg-none",
        "severity": "critical",
        "title": "Algorithm None",
        "detail": "alg=none disables signature verification...",
        "pass": true
      }
    ]
  }
}

Security checks

Every token is run through 8 automated checks. Results are returned in the data.checks array.

Error codes

Code examples

JavaScript / Node.js

const response = await fetch('https://avsig.vercel.app/api/v1/inspect', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'avsig_your_key_here',
  },
  body: JSON.stringify({ token: userJWT }),
})

const { data } = await response.json()

if (data.summary.risk === 'critical') {
  throw new Error('Dangerous JWT detected — blocking request')
}

console.log('Trust score:', data.summary.passed, '/', data.summary.total)

Python

import requests

response = requests.post(
    'https://avsig.vercel.app/api/v1/inspect',
    headers={
        'Content-Type': 'application/json',
        'X-API-Key': 'avsig_your_key_here',
    },
    json={'token': user_jwt}
)

data = response.json()['data']

if data['summary']['critical'] > 0:
    raise Exception('Critical JWT vulnerability detected')

GitHub Actions

- name: Scan JWT security
  run: |
    RESULT=$(curl -s -X POST https://avsig.vercel.app/api/v1/inspect \
      -H "Content-Type: application/json" \
      -H "X-API-Key: ${{ secrets.AVSIG_API_KEY }}" \
      -d "{\"token\":\"$JWT_TOKEN\"}")
    
    RISK=$(echo $RESULT | jq -r '.data.summary.risk')
    
    if [ "$RISK" = "critical" ]; then
      echo "Critical JWT vulnerability found — failing build"
      exit 1
    fi

Plans & limits